Re: [Model-t] What are we trying to protect

[Bret Jordan <[e-mail]>]

As I have illustrated, the 4 attack groups cover these general high level attacks that everyone on the internet faces. These are things that I think we CAN do something about. 

I am not suggesting that we should talk about specific instances or specific types of attacks.  Those would be things like how threat actor FOO compromises layer 2 cache on the CPU to jump between virtual machines in cloud provider.  Or how threat actor bar attacks specific IoT devices from a compromised data center in some geo-center to finally launch an attack against a nation’s power grid.  While some of these attacks are interesting and very elaborate in nature.  They are not in scope. 

1) Attacking the system directly.

2) Delivering an attack through a user initiated session or exfiltrating data through said session

4) Passive monitoring of all traffic

5) Monitoring and tracking all user's traffic inside their session. 


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."

> On Aug 5, 2019, at 9:10 AM, Christian Huitema <[e-mail]> wrote:
> 
> 
> 
> 
>> On Aug 5, 2019, at 7:07 AM, Bret Jordan <[e-mail]> wrote:
>> 
>> I fully get that many here do not understand the attack lifecycle at the same level or understand what an intrusion set is and how that relates to threat actor techniques, tactics, and procedures (or their modus operandi). I also know that most here probably do not track threat actor activity.  But some of us do.  We need to bring some of this knowledge and expertise in to the IETF to help insure that we design things that improve overall security for end users on the internet.
> 
> I am sure that some of us do understand the struggle against progressive penetration of organizations networks and eventual looting of customer data and corporate secrets. On the other hand, the IETF is not going to opine on specific techniques like isolation of credentials or monitoring active directory servers, or on the signal to noise ratio of intrusion detection systems. I want to wait until we have an actual list of goals and assets, but I suspect that we will need limits.
> 
> Some things might be in scope, though. Many of the penetration attacks start with phishing campaigns, using either web access or email. And SMTP is probably in scope. But phishing through social networks would not be.
> 
> -- Christian Huitema 
> -- 
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t