2 ms·

The words "threat model" gets thrown around, but I'm not actually sure "our threat model didn't include our OS vendor" would be considered an acceptable excuse.

The words "threat model" gets thrown around, but I'm not actually sure "our threat model didn't include our OS vendor" would be considered an acceptable excuse. Sure, we have reasons to trust Redhat; - You can look at their working practices ( Good coding hygiene, Peer Review, Tools, etc ) - You can make the commercial argument ( they make money by doing the right thing, it's not in their interest to hack us ) But ultimately we're still explicitly trusting 1000s of people here, so reality is much more nuanced. - Hardern your OS, i.e. only install the bare essentials. - Monitoring for processes or networking traffic doing unexpected things. Thus, you evidence that you reasonably trust the vendor but you'd expect to see an alert were to prove false. Probably a better use of "threat model" would be, we don't need to place trust in developer end user devices because we instead place our trust in our SCM, CI/CD and the SDLC process.

kelnos 6y ago
> The words "threat model" gets thrown around, but I'm not actually sure "our threat model didn't include our OS vendor" would be considered an acceptable excuse. I can't recall any threat-modeling session I've been a part of, or any infosec security professional I've talked to, who has seriously considered the OS vendor as a threat. "Our threat model didn't include the OS vendor" absolutely is an acceptable excuse. Your mitigations (only install bare essentials, network monitoring) are good advice in general, and people should be doing those things regardless of any perceived threat from the OS vendor. Aside from that, really the only way you can absolutely harden yourself assuming a hostile OS vendor is to... not use an OS, and build your entire system from scratch. Which, again, sure, might be a perfectly reasonable thing to do for some ultra-sensitive applications, but -- again -- that is a teeny tiny fraction of a percent of what's actually happening out in the world.
- ownagefool 6y ago
  First point, depends on what you work on I guess. Most of the world doesn't patch, but that doesn't mean managing your dependencies isn't important. On the last point, doing it all yourself probably isn't actually better. Most people don't have the time in the day to invent the universe, so you're always back to figuring out how you establish trust.

kelnos 6y ago

> The words "threat model" gets thrown around, but I'm not actually sure "our threat model didn't include our OS vendor" would be considered an acceptable excuse. I can't recall any threat-modeling session I've been a part of, or any infosec security professional I've talked to, who has seriously considered the OS vendor as a threat. "Our threat model didn't include the OS vendor" absolutely is an acceptable excuse. Your mitigations (only install bare essentials, network monitoring) are good advice in general, and people should be doing those things regardless of any perceived threat from the OS vendor. Aside from that, really the only way you can absolutely harden yourself assuming a hostile OS vendor is to... not use an OS, and build your entire system from scratch. Which, again, sure, might be a perfectly reasonable thing to do for some ultra-sensitive applications, but -- again -- that is a teeny tiny fraction of a percent of what's actually happening out in the world.

ownagefool 6y ago
First point, depends on what you work on I guess. Most of the world doesn't patch, but that doesn't mean managing your dependencies isn't important. On the last point, doing it all yourself probably isn't actually better. Most people don't have the time in the day to invent the universe, so you're always back to figuring out how you establish trust.