Re: [Model-t] w3c also thinking about threat models

[Christian Huitema <[e-mail]>]

> On Sep 23, 2019, at 5:32 AM, Stephen Farrell <[e-mail]> wrote:
> 
> Bret,
> 
>> On 23/09/2019 15:41, Bret Jordan wrote:
>> 
>> Given how nearly all attacks, campaigns, malware, and intrusion sets
>> use the web or software connecting to the web 
> 
> Malware (ab)using the web doesn't imply anything about
> what might be right or wrong with the current web security
> model though. Same as malware doing that doesn't imply
> anything about the security model for IP, which is also
> in use in almost all such cases.

Au contraire!

The past decades should have taught us that bug happens and are exploited. That's very relevant for the Internet threat model. If a server is exploited, will clients and further servers fall off like dominoes? What kind of defense in depth have we built in the architecture? How do we isolate nodes when they are faulty? What remediation strategies do we have available ?

You can apply this analysis to multiple subsystems. For example, if a name server is compromised, can the attackers gain access to the domains that it serves? Can they obtain certificates?

-- Christian Huitema