Skip to content

Free for nonprofits, NGOs, think tanks, and institutes. Grant funded by James Scott, administered by the Embassy Row Project.

ArtOfTheHack home

8 minute read

Evidence Standards for Cyber Decisions

Not all telemetry is equal. Reliability, freshness, independence, and corroboration determine what an assertion can support.

Provenance first

Before evidence can support a conclusion it must carry its own history: which system produced it, when, under what collection conditions, and whether it has been transformed since.

Four properties that determine weight

Weight is not a property of a data source in general. It is a property of a specific item of evidence in relation to a specific claim.

  • Reliability: the historical accuracy of the source for this class of claim
  • Freshness: whether the observation still describes the current state
  • Independence: whether two supporting items share a common origin
  • Corroboration: whether independent sources agree, and where they conflict

Contradiction is information

When two sources disagree, the disagreement itself is often the most valuable signal in the incident. Systems that silently pick a winner destroy that signal. Systems that surface and score it give the analyst the fastest path to the truth.