<html><body><div>From that point of view i agree with you, but i still think it's a very complex topic for this document.</div><div>Maybe we should write another document with a focus on security management where the idea of a threat model fits in perfectly.</div><div><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap" data-mce-style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap;">regards</pre><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap" data-mce-style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap;">Mit freundlichen Grüßen
Andreas Mirbach
Zum Römersprudel 101
54294 Trier
+49 160 94980084</pre></div><div><br>On 14 Jan, 2014,at 09:36 PM, arne renkema-padmos <arne.renkema-padmos@cased.de> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch">On 14/01/14 11:06, Andreas Mirbach wrote:<br><blockquote class="quoted-plain-text" type="cite"><blockquote class="quoted-plain-text" type="cite">2. Threat modelling: Eva mentioned that most guides first focus on a threat</blockquote></blockquote><blockquote class="quoted-plain-text" type="cite"><blockquote class="quoted-plain-text" type="cite">model. We don't really do that so much in ours.</blockquote></blockquote><blockquote class="quoted-plain-text" type="cite"><blockquote class="quoted-plain-text" type="cite">Are we missing something here?</blockquote></blockquote><blockquote class="quoted-plain-text" type="cite"></blockquote><blockquote class="quoted-plain-text" type="cite">I Don't think that we need a Threat model because it shrinks the focus onto this</blockquote><blockquote class="quoted-plain-text" type="cite">model. Everything else is left out.</blockquote><blockquote class="quoted-plain-text" type="cite">I Think we should provide an overall preventive security configuration and not</blockquote><blockquote class="quoted-plain-text" type="cite">how to defend specific threats. (Maybe there can be smaller document with</blockquote><blockquote class="quoted-plain-text" type="cite">different threats that can be referenced)</blockquote><br> From what I understood the problem wasn't so much that they do / don't<br> include a threat model, but that they don't include the concept of<br> threat modelling, and determining what advice is and is not relevant in<br> the readers context. AFAIK, these guides start off with a specific<br> threat model, and don't discuss the concept of threat modelling.<br> <br> There was also some talk about how persecuted groups generally tend to<br> have a good model of the threats that they are up against. How this maps<br> to security technology is another matter, and what's missing from any<br> guides. I guess administrators must also have quite some experience with<br> different kinds of threats, which is what a threat modelling section<br> could build on.<br> <br> Cheers,<br> arne<br> <br> --<br> Arne Renkema-Padmos<br> @hcisec, <a href="http://secuso.org" data-mce-href="http://secuso.org">secuso.org</a><br> Doctoral researcher<br> CASED, TU Darmstadt<br> _______________________________________________<br> Ach mailing list<br> <a href="mailto:Ach@lists.cert.at" data-mce-href="mailto:Ach@lists.cert.at">Ach@lists.cert.at</a><br> <a href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach" data-mce-href="http://lists.cert.at/cgi-bin/mailman/listinfo/ach">http://lists.cert.at/cgi-bin/mailman/listinfo/ach</a><br></div></div></blockquote></div></body></html>