[Model-t] My thoughts on a substantive threat model

[Watson Ladd <[e-mail]>]

Dear all,

Below are my typically uniformed and overly indulgent musings.

Since we are talking about threat models I decided to go back to read
one of the great examples, the Ware report. While from a time before
networking it manages to anticipate a great many of the threats that
we discuss on end user systems, and the great difficulty of security
in an open environment.  However, now we have the ratio of computers
to users being greater then one and the challenge is protecting users
from "themselves" but really the programs they run, something for
which traditional OS models are very unsuited. (I assume of course
that one can implement a security policy and enforce it: absent this
assumption which only seL4 meets, all is hopeless)

But we live in a networked world, and the fundamental gap between
endpoint security and network security has always since the days of
NFS been the general non-representation of principals on the network.
A browser has a very nontrivial task of enforcing a very complex
security policy, and a web application has all sorts of ambient
authority both in the browser and when making requests to other
services from its server that can lead to problems, recapitulating the
ontology of the kernel. The only two systems I know of that really
tried to address this are Plan 9 and Ethos. Athena and AD on Windows
can come half-way, but they aren't very universal: most Windows
machines aren't part of AD in any way, and websites certainly don't
use it mostly. I'm certain there are other attempts, and I am not as
familiar with Athena and Windows as I should be.

If we want to make an adequate threat model including endpoint
security, it's hopeless. Endpoint compromise leaves one with nothing,
likewise host compromise (even ignoring that these are traditionally
differentiated on budget) You need an enclave ala U2F security keys,
but that needs to be done correctly, and even then helps marginally.
(They get to read your email when logged in, but don't retain access.
A win? Yes, but they still got your email)

But what I think we can do is pay attention to principals and the
sadly distributed nature of security policy enforcement, and try as
much as possible to make mechanisms that are in one place and easy to
use to enforce security. This unfortunately is research and involves
APIs.

By contrast I'm very uninterested in just how big the latest default
public S3 bucket is or what's in it. We've established the principle,
the rest is just haggling, and it isn't clear what a threat model that
say "you might have very valuable resources with bad permissions due
to configuration errors" does to inform protocol designers.

It does seem we have quite a few perspectives on what's missing, and
hopefully we can come to some sort of idea about
commonalities/scoping. I've found the conversations rather
illuminating as to the diversity of perspectives.

Sincerely,
Watson Ladd