Re: [Model-t] What are we trying to protect

[Watson Ladd <[e-mail]>]

On Mon, Aug 5, 2019, 8:41 AM Bret Jordan <[e-mail]> wrote:

> As I have illustrated, the 4 attack groups cover these general high level
> attacks that everyone on the internet faces. These are things that I think
> we CAN do something about.
>

What do you concretely propose we change in an existing protocol to deal
with them and how does the threat model lead to that? Can this threat model
do that?


> I am not suggesting that we should talk about specific instances or
> specific types of attacks.  Those would be things like how threat actor FOO
> compromises layer 2 cache on the CPU to jump between virtual machines in
> cloud provider.  Or how threat actor bar attacks specific IoT devices from
> a compromised data center in some geo-center to finally launch an attack
> against a nation’s power grid.  While some of these attacks are interesting
> and very elaborate in nature.  They are not in scope.
>

They are in scope insofar as capabilities they have derive from failures of
systems to provide security properties.


> 1) Attacking the system directly.
>

What can the IETF do against this one?


> 2) Delivering an attack through a user initiated session or exfiltrating
> data through said session
>

What's an attack? How do we e.g. stop the latest UAF against $BROWSER? Some
of these bugs are real fun, but I don't know what any standards body can do
about them.


> 4) Passive monitoring of all traffic
>
> 5) Monitoring and tracking all user's traffic inside their session.
>

What happened to confused deputies etc? This is so high level I don't see
how to get security properties out.

Fundamentally the bolt on security model is kaput. I don't disagree we
should expand the threat model but it needs to be a model of attacker
capabilities, not behavior, and goals that we want systems to meet.

I think it's realistic to have a model where U2F looks like a good idea to
stop phishing because users are not good at password management. I think
it's also reasonable to have a model where privacy risks of third party
cookies/other similar models are discussed. But "attacks"? I don't know how
to think about "attacks".


>
> Thanks,
> Bret
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
> can not be unscrambled is an egg."
>
> On Aug 5, 2019, at 9:10 AM, Christian Huitema <[e-mail]> wrote:
>
>
>
>
> On Aug 5, 2019, at 7:07 AM, Bret Jordan <[e-mail]> wrote:
>
> I fully get that many here do not understand the attack lifecycle at the
> same level or understand what an intrusion set is and how that relates to
> threat actor techniques, tactics, and procedures (or their modus operandi).
> I also know that most here probably do not track threat actor activity.
> But some of us do.  We need to bring some of this knowledge and expertise
> in to the IETF to help insure that we design things that improve overall
> security for end users on the internet.
>
>
> I am sure that some of us do understand the struggle against progressive
> penetration of organizations networks and eventual looting of customer data
> and corporate secrets. On the other hand, the IETF is not going to opine on
> specific techniques like isolation of credentials or monitoring active
> directory servers, or on the signal to noise ratio of intrusion detection
> systems. I want to wait until we have an actual list of goals and assets,
> but I suspect that we will need limits.
>
> Some things might be in scope, though. Many of the penetration attacks
> start with phishing campaigns, using either web access or email. And SMTP
> is probably in scope. But phishing through social networks would not be.
>
> -- Christian Huitema
> --
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t
>
>
> --
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t
>