Subject: Re: [RPSEC] comments on draft-beard-rpsec-routing-threats-01.txt

From: "Ayyasamy, Senthilkumar (UMKC-Student)" <[email-masked]>
Date: Fri, 14 Mar 2003 09:44:32 -0600

Steve,

> BTW, these are attacks, not threats. I still maintain that 
> we need a threat model, not just a list of attacks. 

Yes. But, It's good to list the attacks...Possibly, the title 
and scope of the draft can be modified to reflect your comments. 

anyway, I don't think a big gap exists between attacks and
possible threats. You have anything specific in mind?

- Senthil.

_______________________________________________
RPSEC mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rpsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 18 Mar 2003 11:50:21 -0500

>possible threats. You have anything specific in mind?

I would characterize threats based on their goals and capabilities. 
So, for example, some threats focus on DoS on a local or global 
basis, others strive to divert traffic for passive or active 
wiretapping, etc.  The means by which the threats act is a function 
of their capabilities and their aversion to detection. So, for 
example, anyone can try to send traffic to an interface with a 
spoofed IP address, but some adversaries also can engage in active 
wiretapping on an inter-router link, others could compromise a router 
or a management station used to control a router, others might bribe 
an operator, etc.

Before listing attacks, I think we should characterize threats in 
this fashion, and then show how different attacks fit into different 
threat models.

Steve