The four variables
Where the data can actually be captured
The second variable: harvestability — the concrete surfaces where an adversary could plausibly capture protected data today.
6 min read · 5 min 43 sec film
What you'll be able to do
- Define harvestability and explain why it gates HNDL exposure even when data is long-lived.
- List the main capture surfaces: transit, backups and archives, third parties, logs, and replicas.
- State when no capture path has been identified under a defined threat model, and what could change that finding.
Lesson film
Watch: Where the data can actually be captured
Trace every durable copy of one internal-only database, and the exposure turns out to live nowhere near the system you protected.
5 min 43 sec · 7 scenes
5 min 43 sec, narrated by your browser's voice. Captions and a full transcript are below — nothing here needs sound.
Confidentiality lifetime answered how long it matters. This variable answers whether an adversary could get a copy at all.
With the player focused: Space plays or pauses, ← → seek ten seconds, Home restarts, M toggles narration.
Full transcript
1. The second condition
2. Five surfaces
3. Follow the copies
4. Where the exposure sits
5. Wrapping moves the question
6. What is actually hard
7. Takeaway
The written lesson
Confidentiality lifetime answers how long it matters. Harvestability answers whether an adversary could plausibly get a copy today. Both have to be true for HNDL risk to exist — a data flow that cannot realistically be captured is not HNDL-exposed, regardless of how sensitive or long-lived the data is.
| Surface | What makes it capturable |
|---|---|
| Network transit | Internet-exposed traffic can be captured by a passive collector anywhere on the path; internal-only traffic needs a foothold inside the network first. |
| Backups and archives | Often copied to lower-security storage, retained far longer than the live system, and reviewed far less often. |
| Third parties and processors | Any vendor, partner, or processor that receives or stores the data extends the set of places it can be captured from — the data is only as protected as the weakest custodian. |
| Logs and telemetry | Frequently capture more of the original payload than intended, and are often held to a lower retention and access standard than the system they describe. |
| Replicas and data lakes | Copies made for analytics, disaster recovery, or search often outlive and out-scope the access controls on the source system. |
Internet paths and durable copies — backups, logs, replicas, third-party stores — are useful first checks. An internal, short-lived flow may have fewer capture paths under a specified adversary model, but endpoints, insiders, media, and vendor copies can change that conclusion.
Harvestability narrows the field. The next variable asks, for whatever is left, exactly which cryptography stands between an adversary and the data.
The capture analysis is specific to an adversary and artifacts. A passive internet observer may see a handshake and encrypted records but not a private key. A cloud-storage intruder may see a backup and wrapped data key but not the key-management service. An internal-only system can still have credible capture routes through insiders, compromised endpoints, removable media, and monitoring copies.
Primary reading and claim sources
Publication status checked on the date shown. Draft guidance can change.
- SP 800-30, Revision 1: Guide for Conducting Risk AssessmentsNIST · Final guidance · checked 2026-09-26
- TR 104 016: A Repeatable Framework for Quantum-Safe MigrationsETSI · Published technical report · checked 2026-09-26
Marking a lesson complete only updates this browser.