Re: [Model-t] w3c also thinking about threat models

["Joel M. Halpern" <[e-mail]>]

It seems pretty clear to me that if we take the view that everything is 
in scope, we will not produce any useful improvements in our current 
security considerations in any reasonably measurable time.

It seems to follow that if we want useful results, we had best find 
somewhere to draw a line and agree that we will deal with some 
well-defined scope.

Of course, if all people want is a place to complain about the 
interaction of architecture, protocol, implementation, and underlying 
hardware flaws, I guess we can just complain forever.

Yours,
Joel

On 9/23/2019 1:45 PM, Christian Huitema wrote:
> 
> 
>> On Sep 23, 2019, at 5:32 AM, Stephen Farrell <[e-mail]> wrote:
>>
>> Bret,
>>
>>> On 23/09/2019 15:41, Bret Jordan wrote:
>>>
>>> Given how nearly all attacks, campaigns, malware, and intrusion sets
>>> use the web or software connecting to the web
>>
>> Malware (ab)using the web doesn't imply anything about
>> what might be right or wrong with the current web security
>> model though. Same as malware doing that doesn't imply
>> anything about the security model for IP, which is also
>> in use in almost all such cases.
> 
> Au contraire!
> 
> The past decades should have taught us that bug happens and are exploited. That's very relevant for the Internet threat model. If a server is exploited, will clients and further servers fall off like dominoes? What kind of defense in depth have we built in the architecture? How do we isolate nodes when they are faulty? What remediation strategies do we have available ?
> 
> You can apply this analysis to multiple subsystems. For example, if a name server is compromised, can the attackers gain access to the domains that it serves? Can they obtain certificates?
> 
> -- Christian Huitema
>