Re: [Model-t] What are we trying to protect

[Christian Huitema <[e-mail]>]

 

> On Aug 5, 2019, at 7:07 AM, Bret Jordan <[e-mail]> wrote:
> 
> I fully get that many here do not understand the attack lifecycle at the same level or understand what an intrusion set is and how that relates to threat actor techniques, tactics, and procedures (or their modus operandi). I also know that most here probably do not track threat actor activity.  But some of us do.  We need to bring some of this knowledge and expertise in to the IETF to help insure that we design things that improve overall security for end users on the internet.

I am sure that some of us do understand the struggle against progressive penetration of organizations networks and eventual looting of customer data and corporate secrets. On the other hand, the IETF is not going to opine on specific techniques like isolation of credentials or monitoring active directory servers, or on the signal to noise ratio of intrusion detection systems. I want to wait until we have an actual list of goals and assets, but I suspect that we will need limits.

Some things might be in scope, though. Many of the penetration attacks start with phishing campaigns, using either web access or email. And SMTP is probably in scope. But phishing through social networks would not be.

-- Christian Huitema