You're Asked to Prove a Security Control Works. What Do You Actually Show?

👉 Need help with your IT or cybersecurity career? Work with me: https://professorsimon.com/guidance If your lead asks you to prove a security control works and the console shows everything green, is that proof? This video walks through four questions for answering an evidence request honestly: what are we trying to prove, what evidence would actually show that, can we trust what we're looking at, and what can't we prove yet. It is for IT professionals moving into security and early-career practitioners who are asked to gather, check and explain evidence within their own responsibilities. I am not telling you what any auditor wants, and the example, endpoint protection on company laptops with invented numbers, is made up. The example in this video is made up, including its numbers, and does not describe any real person, organization or system. What you'll learn: • Why a settings screenshot shows how a control is configured, and not that it operated • What a console report can and cannot establish, and why a report run today does not describe the whole quarter • How to check that evidence can be trusted: where it came from, dates and filters, who can change the list, and whether someone else could reproduce it • Why two lists that do not match cannot yet be treated as a protection gap, and how to say what you can't prove yet • What you can and can't change in evidence, and why you never backdate or falsify it • A one-page evidence note you can write for a control you support CHAPTERS 0:00 Is a Green Console Proof That Endpoint Protection Works? 1:07 How to Scope a Security Evidence Request 1:41 What Does "Working" Mean for a Security Control? 2:11 What Evidence Shows a Security Control Is Operating? 3:51 Can You Trust a Security Report as Evidence? 4:46 Why Console and Inventory Counts Don't Match 5:30 What to Do When You Can't Prove a Control Works 6:07 What You Can and Can't Change in Security Evidence 6:35 Evidence Note Example for a Security Control 8:15 How to Write a One-Page Evidence Note for a Control 📝 Companion Blog Post: https://professorsimon.com/blog/prove... 🎧 Listen to the Podcast on Spotify: https://professorsimon.com/podcast 🔗 Resources, blog & more: https://professorsimon.com/links 💼 LinkedIn:   / leonardsimon   📸 IG / 🐦 X / 🎵 TikTok: @profsimononline If you found this helpful, subscribe for practical IT and cybersecurity lessons every week. #SecurityControls #SecurityEvidence #CybersecurityCareers