Shakedown Social

0 posts0 participants0 posts today

tuxwise(19/N) Let's now turn to the third question of the <a href="https://mastodon.de/tags/ThreatModelingManifesto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModelingManifesto</a>: 3. What are you going to do about it?It pays to first establish a few contraints for what you can do, in theory, by <a href="https://mastodon.de/tags/classifying" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#classifying</a> your <a href="https://mastodon.de/tags/assets" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#assets</a>. Again, for an individual human being, opposed to organizations or companies, it's nearly impossible to impose principles like <a href="https://mastodon.de/tags/ZeroTrust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ZeroTrust</a> or <a href="https://mastodon.de/tags/NeedToKnow" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NeedToKnow</a> on personal relationships, the closer they get.So, avoid recycling terms from popular, but less intuitive schemes: Fanciful intelligence labels like “top secret”, “confidential”, or “unclassified” do not tell you what goes into the respective box, and how to handle access to it.Add another column to your assets spreadsheet, label it "Classification", and pick a more human-centered approach for its values, like:<ul><li>For Your Eyes Only (FYEO)</li><li>Intimate</li><li>None Of Your Business (NOYB)</li><li>Shared</li><li>Public</li></ul>Let's briefly go through these suggestions:For Your Eyes Only (FYEO)Assets that are only accessible to, and controlled by nobody but you, because they need to be resilient, even in the face of the closest of your close people misbehaving. Preferably, these assets are kept publicly undetectable and unknown. When you are gone, these assets will be gone, too. FYEO does not make a good default class, though.Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(8/N) For now, leave your spreadsheet of assets alone and turn to the second question of the <a href="https://mastodon.de/tags/ThreatModelingManifesto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModelingManifesto</a>:2. What can go wrong?The answer usually includes a list of adversaries, so you can later consider which ones you stand a chance fighting, if you think it's worth it.Again, this may be helpful for corporations, but not that much for individuals, since damage done to individuals can be much deeper, and last for much longer, even for life.So, lets rather consider abstract categories of adversaries from a perspective of what their primary goals are, and what they usually do to achieve them. We don't bother with specific bad actors here, nor are we considering how to "help them" via psychotherapy, legislation, imprisonment or campaigning, at this point in time.First, the list:<ul><li>🤷 You, and people like you</li><li>💰 <a href="https://mastodon.de/tags/Criminals" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Criminals</a></li><li>☝️ <a href="https://mastodon.de/tags/Ideologues" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ideologues</a></li><li>🫳 <a href="https://mastodon.de/tags/Intruders" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Intruders</a></li><li>🦕 <a href="https://mastodon.de/tags/Business" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Business</a>(i)es</li><li>🏢 “<a href="https://mastodon.de/tags/They" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#They</a>”</li></ul>A few thoughts, on each category:🤷 You, and people like youYou and others prefer to keep asset protection efforts to a minimum. You tend to take the integrity of your assets for granted, hoping that others will respect your boundaries, either out of respect for you or because of legal regulations and repercussions. Your attitude towards handling the assets of others is equally shortsighted and careless.As a result, your digital assets stay exposed, and you're putting others at risk, too.(to be continued)Start of this thread: <a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreadModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreadModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

tuxwise(2/N) The "<a href="https://mastodon.de/tags/ThreatModelingManifesto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModelingManifesto</a>" is a great framework for businesses and organizations. Applying it to a more private context becomes easier for me when I make its key questions more personal:<ol><li>What are you working on?</li><li>What can go wrong?</li><li>What are you going to do about it?</li><li>Did you do a good enough job?</li></ol>Next two posts will cover my answers to 1).<a href="https://www.threatmodelingmanifesto.org/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.threatmodelingmanifesto.org/</a>Note: Essentially, the <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>s are my answers to 3).<a href="https://mastodon.de/@tuxwise/113503228291818865" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://mastodon.de/@tuxwise/113503228291818865</a><a href="https://mastodon.de/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatModeling</a> <a href="https://mastodon.de/tags/4D" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#4D</a>

Recent searches

Search options

Administered by:

Server stats:

#threatmodelingmanifesto