A User-Focused Internet Threat Model
draft-lazanski-users-threat-model-t-00

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00

Independent Submission                                      D. Lazanski
Internet Draft                                         Last Press Label
Intended status: Informational                            March 8, 2020
Expires: September 9, 2020

                   A User-Focused Internet Threat Model
                  draft-lazanski-users-threat-model-t-00

Status of this Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six
   months and may be updated, replaced, or obsoleted by other documents
   at any time.  It is inappropriate to use Internet-Drafts as
   reference material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html

   This Internet-Draft will expire on September 9, 2020.

Copyright Notice

   Copyright (c) 2020 IETF Trust and the persons identified as the
   document authors. All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document. Please review these documents
   carefully, as they describe your rights and restrictions with
   respect to this document. Code Components extracted from this
   document must include Simplified BSD License text as described in
   Section 4.e of the Trust Legal Provisions and are provided without
   warranty as described in the Simplified BSD License.

Lazanski              Expires September 9, 2020                [Page 1]
   Internet-Draft A User-Focused Internet Threat Model      March 2020

Abstract

   RFC 3552 introduces a threat model that does not include endpoint
   security. RFC 3552 is 15 years old and in those 15 years the threat
   landscape has changed. Security issues and cyber attacks have
   increased and there are more devices, users, and applications on the
   endpoint than ever. This draft proposes a new approach to the
   Internet threat model which will include endpoint security, focus on
   users and provide an update to the threat model in RC 3552.

Table of Contents

   1. Introduction...................................................2
   2. A History of Data Breaches.....................................3
   3. Botnets........................................................5
   4. Emerging Threats...............................................6
   5. Impacts........................................................7
   6. Guidelines.....................................................7
   7. A New Internet Threat Model....................................7
   8. Way Forward....................................................8
   9. Security Considerations........................................9
   10. IANA Considerations...........................................9
   11. Conclusions...................................................9
   12. References....................................................9
      12.1. Informative References...................................9
   13. Acknowledgments..............................................11

1. Introduction

   Data breaches are on the rise: personal data is stolen and often
   leaked or sold on a never-before-seen scale. Malware and ransomware
   attacks impact the most vulnerable in our global societies today.
   Better security results in better privacy through prevention of
   these breaches. However, even though the IETF is privacy-focused,
   policy and design decisions taken by the IETF have radically changed
   the architecture of the Internet, arguably without due consideration
   to cyber defence implications or outcomes.

   In recent years, this has obsoleted many systems, technologies and
   programmes which use Internet protocols for prevention, detection
   and mitigation of cyber attacks. RFC 7258 established that
   "Pervasive Monitoring" is an attack on privacy that needs to be
   mitigated where possible. Furthermore, RFC 3552 assumes that the
   endpoints involved in a communications exchange have not been
   compromised, but that the attacker has near complete control over
   the network between the endpoints rather than the endpoints
   themselves.  These assumptions have led to a focus on communications

Lazanski              Expires September 9, 2020                [Page 2]
   Internet-Draft A User-Focused Internet Threat Model      March 2020

   security and the development of protocols that place this kind of