Re: [Model-t] [e-mail] list description

[Jim Fenton <[e-mail]>]

On 8/2/19 9:24 PM, Bret Jordan wrote:

> To borrow your words…  “If we are going to take security seriously”…
>  we need to understand and document the full attack surface.  So let
> us start listing them out.  Here are four.
>
>
> Attack: Active remote attack
> Exposure: Full compromise of system and data
> Client Knowledge: Potential indicators may be visible
> Protection Possibilities: Deploy both client and network level protections
> Headwinds: Client based protections are usually inadequate
> Severity: High
> Kill-Chain Phase: Lateral Movement

[etc.]

Perhaps we need to decide what we consider a threat model to be. I see
Bret's list as a collection of specific attacks (tactics), while I
consider a threat model to be at a higher level than that, e.g., whether
nation-states, or supply chain threats, should be part of that model.

When I was working on the draft that became RFC 4686 (DKIM Threat
Analysis), Russ Housley gave me some very good coaching about how to
structure that. He suggested that it should describe:

- The nature and location of the bad actors
- What the bad actors' capabilities are
- What they intend to accomplish via their attacks

How do we want to define threat model?

-Jim