Re: [Model-t] [e-mail] list description

[Bret Jordan <[e-mail]>]

I did not use anything from STIX. Are you referring to the use of kill chain phase? 

Bret 

Sent from my Commodore 64

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

> On Aug 3, 2019, at 7:33 AM, Stephen Farrell <[e-mail]> wrote:
> 
> 
> Hiya,
> 
> Two things:
> 
> - I'm not sure how applicable stix and other information model
> type approaches might be for addressing an Internet threat model,
> but that seems like a topic that'd deserve a thread or two...
> 
> - I generally like the attack surface metaphor and find it useful
> in thinking about security when making changes to a specific
> system or network. So that metaphor could certainly be useful.
> I'm not sure though that there is such a thing as "the full
> attack surface" that can be usefully enumerated.
> 
> Thanks,
> S.
> 
>> On 03/08/2019 05:24, Bret Jordan wrote:
>> To borrow your words…  “If we are going to take security seriously”…  we need to understand and document the full attack surface.  So let us start listing them out.  Here are four.
>> 
>> 
>> Attack: Active remote attack
>> Exposure: Full compromise of system and data
>> Client Knowledge: Potential indicators may be visible
>> Protection Possibilities: Deploy both client and network level protections
>> Headwinds: Client based protections are usually inadequate
>> Severity: High
>> Kill-Chain Phase: Lateral Movement 
>> 
>> Attack: Active in-band attack
>> Exposure; Full compromise of system and data
>> Client Knowledge: Potential indicators may be visible
>> Protection Possibilities: Deploy both client and network level protections, user awareness training, content and DNS filtering
>> Headwinds: Client based protections are usually inadequate
>> Severity: High
>> Kill-Chain Phase: Delivery and Exploitation 
>> 
>> Attack: Passive monitoring of traffic
>> Exposure: Information about where traffic is going and potentially details of the content being shared 
>> Client Knowledge: No, it is very hard to detect passive monitoring tools
>> Protection Possibilities: Encrypt traffic 
>> Headwinds: Global adoption of better encryption
>> Severity: Low
>> Kill-Chain Phase: Reconnaissance
>> 
>> Attack: Active in-band monitoring and tracking 
>> Exposure: Information about what the user is doing and where they are going 
>> Client Knowledge: Generally no 
>> Protection Possibilities: Client and network level protections
>> Headwinds: Some clients are making it hard to deploy client side protections 
>> Severity: Low
>> Kill-Chain Phase: Reconnaissance
>> 
>> 
>> 
>> Thanks,
>> Bret
>> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
>> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
>> 
>>> On Aug 2, 2019, at 9:18 PM, Martin Thomson <[e-mail]> wrote:
>>> 
>>> On Sat, Aug 3, 2019, at 03:58, Michael Richardson wrote:
>>>> What I'm trying to say is that there are some threats that we deal with
>>>> on the Capital-Internet that are far more manageable in the small.
>>> 
>>> Like a red rag to a bull...
>>> 
>>> I don't think that this is a sustainable attitude.  If we are going to take security seriously, we have to consider every networked device to be exposed to a hostile environment.  Now that doesn't mean that you can't take steps to limit hostility in networks, and there might be sound reasons to believe that the degree to which you have to expend resources in defense of certain attacks is different as a result.  But the notion of a gooey middle remains a big part of the problem statement.
>>> 
>>> This isn't really on-topic for this list as I understand it, and I wasn't planning to say much here until someone said this.  Sorry Michael :)
>>> 
>>> -- 
>>> Model-t mailing list
>>> [e-mail]
>>> https://www.iab.org/mailman/listinfo/model-t
>> 
>> 
>> 
> <0x5AB2FAF17B172BEA.asc>