Re: [Model-t] [e-mail] list description

[Eric Rescorla <[e-mail]>]

Bret,

I'm having a fair amount of trouble understanding what these attacks you
are referring to mean. Perhaps you could lay them out in more detail?

-Ekr


On Fri, Aug 2, 2019 at 9:24 PM Bret Jordan <[e-mail]> wrote:

> To borrow your words…  “If we are going to take security seriously”…  we
> need to understand and document the full attack surface.  So let us start
> listing them out.  Here are four.
>
>
> Attack: Active remote attack
> Exposure: Full compromise of system and data
> Client Knowledge: Potential indicators may be visible
> Protection Possibilities: Deploy both client and network level protections
> Headwinds: Client based protections are usually inadequate
> Severity: High
> Kill-Chain Phase: Lateral Movement
>
> Attack: Active in-band attack
> Exposure; Full compromise of system and data
> Client Knowledge: Potential indicators may be visible
> Protection Possibilities: Deploy both client and network level
> protections, user awareness training, content and DNS filtering
> Headwinds: Client based protections are usually inadequate
> Severity: High
> Kill-Chain Phase: Delivery and Exploitation
>
> Attack: Passive monitoring of traffic
> Exposure: Information about where traffic is going and potentially details
> of the content being shared
> Client Knowledge: No, it is very hard to detect passive monitoring tools
> Protection Possibilities: Encrypt traffic
> Headwinds: Global adoption of better encryption
> Severity: Low
> Kill-Chain Phase: Reconnaissance
>
> Attack: Active in-band monitoring and tracking
> Exposure: Information about what the user is doing and where they are
> going
> Client Knowledge: Generally no
> Protection Possibilities: Client and network level protections
> Headwinds: Some clients are making it hard to deploy client side
> protections
> Severity: Low
> Kill-Chain Phase: Reconnaissance
>
>
>
> Thanks,
> Bret
> PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
> "Without cryptography vihv vivc ce xhrnrw, however, the only thing that
> can not be unscrambled is an egg."
>
> On Aug 2, 2019, at 9:18 PM, Martin Thomson <[e-mail]> wrote:
>
> On Sat, Aug 3, 2019, at 03:58, Michael Richardson wrote:
>
> What I'm trying to say is that there are some threats that we deal with
> on the Capital-Internet that are far more manageable in the small.
>
>
> Like a red rag to a bull...
>
> I don't think that this is a sustainable attitude.  If we are going to
> take security seriously, we have to consider every networked device to be
> exposed to a hostile environment.  Now that doesn't mean that you can't
> take steps to limit hostility in networks, and there might be sound reasons
> to believe that the degree to which you have to expend resources in defense
> of certain attacks is different as a result.  But the notion of a gooey
> middle remains a big part of the problem statement.
>
> This isn't really on-topic for this list as I understand it, and I wasn't
> planning to say much here until someone said this.  Sorry Michael :)
>
> --
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t
>
>
> --
> Model-t mailing list
> [e-mail]
> https://www.iab.org/mailman/listinfo/model-t
>