3 ms·
"Give me a threat model, by which I mean realistic groups with goals and capabilities, and we can mitigate the risks." Thread models are important, but having
by ajmurmann 4y ago
"Give me a threat model, by which I mean realistic groups with goals and capabilities, and we can mitigate the risks."
Thread models are important, but having a concrete adversary in mind is likely misguided. To whom you are an interesting target is hard to know and can change in a heart beat with economic or political events. You don't want to start looking for possible SQL injection vectors once you know someone is targeting you.
I agree though that three threat model should include damage potential and how sophisticated an attacker would have to be.
- generalizations 4y ago> You don't want to start looking for possible SQL injection vectors once you know someone is targeting you. Except that SQL injection vectors are only considered an obvious threat for your example, because the associated concrete adversary is already well-known to everyone here. The point is that without a realistic threat model, you have no idea where to draw the line. If you plan to try and anticipate every possible threat (because who knows if your app's data will be targeted by The Russians next week) then just unplug your hosting servers and put them in a locked room.
- ajmurmann 4y agoI think you can make that decision without knowing the concrete actor. Instead of asking if Russia has a concrete interest in hacking my product I can ask if it's worth it to protect against all possibly attacks from nation state actors. For almost all applications the answer will be "no".