Your threat model is wrong

guest · Jun 1, 2019

Your threat model is wrong
May 29, 2019
https://blog.erratasec.com/2019/05/your-threat-model-is-wrong.html

Several subjects have come up with the past week that all come down to the same thing: your threat model is wrong. Instead of addressing the the threat that exists, you've morphed the threat into something else that you'd rather deal with, or which is easier to understand.
Phishing
An example is this question that misunderstands the threat of "phishing"
The (wrong) threat model is here is that phishing is an email that smart users with training can identify and avoid. This isn't true.
Good phishing messages are indistinguishable from legitimate messages.

In other words, if you paid attention to the threat model, you'd be mitigating the threat in other ways and not even bother training employees.
Click to expand...

IoT security
My threat model for Internet-ending events are three:
• Windows vulns / something else exposed to the public Internet / automatic updates of a popular product
IoT isn't in this list.
Catastrophic ransomware infections
[...] Yes, EternalBlue was used in those two attacks, but had it been EternalBlue alone, it would've been the first example of a few unpatched systems that needed to be fixed. What caused the $billion in damage was spreading via Windows credentials.

I've looked at lots of crippling ransomware attacks, including notPetya. What makes them crippling is never anything but this problem of Windows credentials and 'psexec' style lateral movement. This is your threat model.
Click to expand...

guest · Jun 1, 2019

Responding to Rob Graham’s “Your Threat Model is Wrong” Post
May 30, 2019
https://danielmiessler.com/blog/responding-to-rob-grahams-your-threat-model-is-wrong-post/

Phishing
First, he argues that it’s wrong to fire people for failing phishing tests because it’s impossible to pass them.
[...] but today’s reality is that the user is still often the last line of defense, and that the more trained and cautious they are the better posture the entire company will have.
Internet of Things
The future doesn’t have IoT devices, it has everyday things that are online. Cars, houses, cities, roads, lights, power, water, etc. And the thing that makes their connectivity useful is having it be…well, connected.
We must be disagreeing on terminology here, because things online that control the world around us WILL LARGELY BE THE IOT.

I agree with Rob that people often get distracted by the wrong threat scenarios and end up worrying about and fixing the wrong things. I also agree that fixing admin rights is more important than launching phishing campaigns.
But you don’t have to choose one. Many organizations can, have to, and are doing both.
Click to expand...

Log in or Sign up

Your threat model is wrong

guest Guest

guest Guest

Log in or Sign up

Your threat model is wrong

guest Guest

guest Guest

Useful Searches