Re: [Model-t] (meta) Trust, and threat vs vulnerability models

As promised, here's an attempt to capture what I think we were edging towards in the exchange between me and Dirk. I’m hoping this will help us get to consensus about the scope and purpose of what the group will work on.

I appreciate the misgivings EKR expressed about scope, and about whether we are actually talking about anything new, here. I think that may be an inevitable consequence of framing this as a “threat” model as opposed to a vulnerability model. The former, in principle, is a non-finite list, whereas the latter can be finite... so we may be talking about a never-ending list of emerging threats, but they might all target existing vulnerabilities which are known, understood and mitigated already. Maybe the most useful goal of this group is to work out the fastest and most reliable way of telling whether or not that is the case.

So, we might formulate a question like this: "does a shift towards information-centric networking change the reasons why I should or should not trust the network to behave as I expect?"

If you change the things I rely on when I'm making a trust (or security) decision, you change the threat model. So, for instance, I used to trust intermediary network nodes because they were dumb, and therefore didn't expose a useful attack surface, but now those network nodes are doing more processing, are participating in an ICN reputation scheme, and could potentially be gamed to my detriment. They embody vulnerabilities they didn’t embody before, but which might be known and understood in other contexts. The ways in which an adversary might exploit the intermediate nodes has changed, and I should no longer rely on the reasons I used to rely on, when judging whether those nodes will behave as I (still) expect them to.

So then, in practical terms, we might want RFC authors to think as follows:

- Nodes of type x used to be dumb, but are now functionally rich; this has increased their attack surface, but the resulting vulnerabilities are still:
	- data exfiltration
	- alteration of data in motion
	- denial of service
… and we already have design patterns for mitigating those vulnerabilities from other comparable use cases…

Or…

 - Nodes of type x used to be dumb, but are now functionally rich and participate in reputation schemes that can be gamed so as to modify the network's behaviour; this gives rise to a new vulnerability:
	- manipulation of service levels
… which we have not had to mitigate before, but which could be mitigated by doing z.

I hope this is useful,
Yrs.,
Robin

> On 14 Feb 2020, at 15:31, model-t-request@iab.org wrote:
> 
> Send Model-t mailing list submissions to
> 	model-t@iab.org
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www.iab.org/mailman/listinfo/model-t
> or, via email, send a message with subject or body 'help' to
> 	model-t-request@iab.org
> 
> You can reach the person managing the list at
> 	model-t-owner@iab.org
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Model-t digest..."
> Today's Topics:
> 
>   1. Re: model-t webex chat - Friday Feb 14th 1600 UTC
>      (Stephen Farrell)
>   2. Materials for tonight's call (Jari Arkko)
> 
> From: Stephen Farrell <stephen.farrell@cs.tcd.ie>
> Subject: Re: [Model-t] model-t webex chat - Friday Feb 14th 1600 UTC
> Date: 14 February 2020 at 12:45:15 GMT
> To: Jari Arkko <jari.arkko@piuha.net>
> Cc: "model-t@iab.org" <model-t@iab.org>
> 
> 
> 
> Hiya,
> 
> That agenda seems fine. We can agenda-bash on
> the call as needed.
> 
> We can use this etherpad [1] for notes. If
> someone's willing to help take notes, that'd
> be great.
> 
> Cheers,
> S.
> 
> [1] https://etherpad.ietf.org/p/model-t-valentinessday
> 
> On 13/02/2020 13:17, Jari Arkko wrote:
>> How about this for agenda for tomorrow?
>> 
>> 1. Introduction (Stephen)
>> 2. Getting organised as an IAB program (Jari)
>> 3. Technical discussion (all)
>>    - analysis of threats
>>    - recommendations for threat model update
>>    - other issues
>>    - draft updates
>>      o   draft-arkko-farrell-arch-model-t-02 (Stephen)
>> 4. Any other business
>> 
>> Jari
>> 
> <0x5AB2FAF17B172BEA.asc>
> 
> 
> From: Jari Arkko <jari.arkko@piuha.net>
> Subject: [Model-t] Materials for tonight's call
> Date: 14 February 2020 at 15:30:38 GMT
> To: "model-t@iab.org" <model-t@iab.org>
> 
> 
> Our main discussion item will be around drafts and people’s thoughts and issues. But for the other part, administrative, agenda, and organisation, there are a couple of slides:
> 
> 
> For the drafts that we know of:
> 
> https://tools.ietf.org/html/draft-arkko-farrell-arch-model-t-02 <https://tools.ietf.org/html/draft-arkko-farrell-arch-model-t-02>
> http://www.ietf.org/internet-drafts/draft-lazanski-smart-users-internet-00.txt <http://www.ietf.org/internet-drafts/draft-lazanski-smart-users-internet-00.txt>
> 
> See also some other work that’s related but maybe not directly on point in the references of the above two drafts. Other contributions & discussions of your thoughts are welcome!
> 
> Jari & Stephen
> 
> <model-t-org.pdf>
> 
> Model-t mailing list
> Model-t@iab.org
> https://www.iab.org/mailman/listinfo/model-t

Re: [Model-t] (meta) Trust, and threat vs vulnerability models

Attachment: signature.asc