Define high level threat model levels

anton commented

2024-12-02 17:28:27 +00:00

Owner

https://gist.github.com/lrvick/373a42da700e33c39e30dbc2b65d880f

anton self-assigned this 2024-12-02 17:28:32 +00:00

anton added this to the Custody Framework project 2024-12-02 17:28:36 +00:00

anton commented

2024-12-02 17:29:12 +00:00

Author

Owner

This document should be replicated, updated and used as the high level threat model, which can be linked to, and links to other documents such as "tamper proofing methods", "chain of custody", "vaults/safes" etc.

anton added a new dependency 2024-12-04 20:33:26 +00:00

#14 Add references for different attack types in the high level threat model

anton commented

2024-12-04 22:51:57 +00:00

Author

Owner

Going to integrate the CCSS documentation with our threat model and reorganize information. The goal is to have different "aspects" such as "entropy generation", and then all levels specified for that.

The one challenge is how to include higher level assumptions for different levels, so there should exist a section that defines for each level:

Type of threat actors
Types of attacks

This may be sufficient but additional properties may surface as the docs are written.

This document is important to pin down as the whole system is built on these assumptions.

Going to integrate the CCSS documentation with our threat model and reorganize information. The goal is to have different "aspects" such as "entropy generation", and then all levels specified for that. The one challenge is how to include higher level assumptions for different levels, so there should exist a section that defines for each level: * Type of threat actors * Types of attacks This may be sufficient but additional properties may surface as the docs are written. This document is important to pin down as the whole system is built on these assumptions.

anton added the due date 2024-12-17

2024-12-04 22:54:04 +00:00

anton modified the due date from 2024-12-17 to 2024-12-13

2024-12-04 22:58:26 +00:00

anton modified the due date from 2024-12-13 to 2024-12-06

2024-12-05 20:48:08 +00:00

anton commented

2024-12-05 20:48:36 +00:00

Author

Owner

Going to keep the doc in a "simple" form for now, with the intention of circling back and making it more general down the road.

anton added this to the Vaulting Framework Documentation milestone 2024-12-06 01:31:24 +00:00