Originally published at tothenoc.com
Eight days ago I published a piece about thirty years of systems that reported success and shipped nothing. Enabled is not delivering. A green dashboard is a claim, not a measurement.
That article described a problem and stopped there, which is the honest limit of an article. This one is about what I built afterwards, what it costs, and what it deliberately refuses to do.
The service
It is called Konstatum. It answers one question in writing: does the control you believe you have actually do what you believe it does?
Ten working days. One site, one perimeter. One dated document in which every line has four parts — the claim you stated in writing before anything was measured, the method, the raw evidence, and one of three verdicts: confirmed, contradicted, or not tested.
That third verdict is unusual to see written down, and it is not a softer form of failure. It means a claim was not verified; it says nothing about whether the claim is sound. A report containing no such lines is asserting a coverage it does not possess.
The terms, in full
EUR 1,500, fixed. One site, one perimeter, ten working days.
EUR 350–500 per month afterwards, for re-verification of the same lines. Priced separately, and offered only once you have read the first report. A report that is never repeated becomes a document; a report that is repeated is a control.
No remediation. Ever. Not as an option, not for an additional fee, not at any point. An assessor who also sells the repair has an interest in finding one. Where something needs putting right it goes to whoever already looks after your systems — and I remain able to verify their work afterwards, which I could not do had I performed it myself.
Not a penetration test. Not monitoring. Not a certificate. Those exclusions are written into the engagement, because a document that states plainly what it did not examine is far harder to attack than one implying it examined everything.
Paid, deliberately. A complimentary security assessment is an instrument of sale and everyone in the room understands it as such. One you commissioned is an opinion.
Why the claims come first
Nothing is measured until you have written down what you believe to be true, and signed it. This is the declaration, and its position in the sequence is not a formality.
An assessor working alone cannot distinguish a deficiency from a decision. A firewall accepting all inbound traffic is a serious finding — unless filtering happens upstream by design, in which case reporting it is noise dressed as rigour. In the first full run of the method against my own infrastructure, two findings out of thirty-one were exactly that error. Six per cent of the report was an assessor mistaking a decision for a defect. That rate is not acceptable in a document someone signs, so the order changed.
Where this usually starts
Not with curiosity. It starts when an insurer sends a renewal questionnaire that must be answered in writing and signed, or when a larger client's procurement department begins asking its suppliers the questions its own auditors ask of it.
Those answers get given from memory, from a vendor's dashboard, or from what the IT provider said the last time anyone enquired. All three describe what was intended. None describe what a test would find — and insurers have contested claims on precisely that distinction.
Nullius in verba
"On the word of no one." The motto of the Royal Society, adopted in its first charter of 1662 and taken from Horace. A claim is established by test rather than by the standing of whoever makes it.
Which is why the method was run against my own production infrastructure before it was offered to anyone. Thirty-three verdicts: fourteen confirmed, twelve contradicted, seven not tested. The full report — including the twelve failures and the two findings that turned out to be my error rather than the system's — goes to anyone who asks.
Top comments (0)