Subject: [Model-t] Dependable, secure, flexible and extensible

From: Robin Wilton <[email-masked]>
Date: Wed, 5 Feb 2020 17:33:54 +0000

Hi Russ,

Thanks for spotting this. I expect Ekr will probably have some thoughts about whether this meaningfully changes the scope of what model-t is considering, as (to my recollection) most of the comments about scope, in Singapore, came from him.

Without wanting to second-guess that, my thought is to wonder whether “dependable, secure, flexible and extensible” actually reduce to the standard security triad of confidentiality, integrity and availability. "Dependable, flexible and extensible" might legitimately be considered as “availability” pre-requisites, especially in the sense that a system that is insufficietly flexible or extensible becomes “unavailable" if it cannot respond to changing circumstances or requirements.

Does that help?

Yrs.,
Robin

> On 4 Feb 2020, at 20:00, [email-masked] wrote:
> 
> Send Model-t mailing list submissions to
> 	[email-masked]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	https://www.iab.org/mailman/listinfo/model-t
> or, via email, send a message with subject or body 'help' to
> 	[email-masked]
> 
> You can reach the person managing the list at
> 	[email-masked]
> 
> When replying, please edit your Subject line so it is more specific
> than "Re: Contents of Model-t digest..."
> Today's Topics:
> 
>   1. Is this relevant to Model-T? (Russ Housley)
> 
> From: Russ Housley <[email-masked]>
> Subject: [Model-t] Is this relevant to Model-T?
> Date: 3 February 2020 at 22:37:54 GMT
> To: model-t <[email-masked]>
> 
> 
> https://www.cs.stevens.edu/~nicolosi/papers/FIA14.pdf
> 
> I was searching for something else when I stumbled across this paper.  In Section 3, the authors are talking about the properties that they want from the distributed information utility:  dependable, secure, flexible, and extensible.  Reading between the lines, they seem to be saying that a threat is something that prevents achieving one of these properties.
> 
> Russ
> 
> 
> 
> 
> Model-t mailing list
> [email-masked]
> https://www.iab.org/mailman/listinfo/model-t

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 5 Feb 2020 21:18:37 +0100

On 2020-02-05, at 18:33, Robin Wilton <[email-masked]> wrote:
> 
>  "Dependable, flexible and extensible" might legitimately be considered as “availability” pre-requisites,

It’s the other way around, availability is a component of dependability.
(A system may be available, but not doing the right thing, which makes it less dependable.)

Flexible (capable of doing things that were not expected by the designer) and extensible (enabling designing in things that were previously not expected by the designer) are certainly on the “do the right thing” side as well.

Dependability may require accountability, including third-party verifiability, in addition to the properties in the CIA triad.

Grüße, Carsten

---

From: Robin Wilton <[email-masked]>
Date: Thu, 6 Feb 2020 13:00:39 +0000

Vielen Dank, Carsten - good thinking.

In which case, returning to Russ’ initial note and the question of scope: it seems to me to be appropriate for the threat model to include factors that are not *security* factors (in the sense of factors that deliver confidentiality, integrity and availability).  Now that I think about it a bit more: the CIA triad is usually applied to data rather than systems - and of course the confidentiality, integrity and availability of data depend on much more than the security of the system (application integrity, system integrity, system management, etc…).

Thanks again -
Robin

> On 5 Feb 2020, at 20:18, Carsten Bormann <[email-masked]> wrote:
>