Re: [Smart] [Secdispatch] New Version Notification for draft-lazanski-smart-users-internet-00.txt

[Bret Jordan <[e-mail]>]

Hi Elliot.  

There are a few additional questions to consider, that are more relevant, IMO:


> To your point below, there are three questions we can ask:
> 
> Is the device known to be compromised?
> Is the device not known to be compromised?
> Is the device in a known good state?
> 


1) Is the content or content provider that the user is going to compromised and trying to attack the endpoint?
2) Is the content provider that the user is going to a stage 2 delivery site?
3) Is the content provider that the user is going to the location for outbound malicious content (data exfiltration, CnC traffic)
4) Is the content provider that the user is going to adversely tracking and monitoring everything the end client does, aka active surveillance versus passive surveillance?
5) Is the remote site that the user did not go to attack the end point. 

All of this in network based / Internet based.  Protocol designs can help make it much more difficult for threat actors, crime syndicates, and intrusion sets from being as effective. 


Thanks,
Bret
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."