Re: [Model-t] [e-mail] list description

[Bret Jordan <[e-mail]>]

Jim,

They are not specific attacks, but rather categories of attacks that could be executed by any number of threat actors.  Some threat actors may have different capabilities or different levels of sophistication, but in general, these types of attacks are not specific to a certain classification of threat actor. 

Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 3, 2019, at 10:52 AM, Jim Fenton <[e-mail]> wrote:
> 
> On 8/2/19 9:24 PM, Bret Jordan wrote:
> 
>> To borrow your words…  “If we are going to take security seriously”…
>>  we need to understand and document the full attack surface.  So let
>> us start listing them out.  Here are four.
>> 
>> 
>> Attack: Active remote attack
>> Exposure: Full compromise of system and data
>> Client Knowledge: Potential indicators may be visible
>> Protection Possibilities: Deploy both client and network level protections
>> Headwinds: Client based protections are usually inadequate
>> Severity: High
>> Kill-Chain Phase: Lateral Movement
> 
> [etc.]
> 
> Perhaps we need to decide what we consider a threat model to be. I see
> Bret's list as a collection of specific attacks (tactics), while I
> consider a threat model to be at a higher level than that, e.g., whether
> nation-states, or supply chain threats, should be part of that model.
> 
> When I was working on the draft that became RFC 4686 (DKIM Threat
> Analysis), Russ Housley gave me some very good coaching about how to
> structure that. He suggested that it should describe:
> 
> - The nature and location of the bad actors
> - What the bad actors' capabilities are
> - What they intend to accomplish via their attacks
> 
> How do we want to define threat model?
> 
> -Jim
> 
> 
>