Subject: [VoT] Some thoughts on vectors and trust

From: Scott Shorter <[email-masked]>
Date: Mon, 22 Dec 2014 09:52:05 -0500

Hello list,

I've lurked since early October, and appreciated the excellent discussions
all around. After some digesting, I have some thoughts that I would
appreciate feedback on:

1. Identity trust as inverse of identity risk (and application of the
vectors concept to that model)
2. Proposed RP-centric trust/risk model for credentials
3. Proposed concept of credential scoring as a parallel to vulnerability
scoring

*Trust versus Risk*
Trust is an important word to understand, and that understanding can be
articulated and systematized through the use of a trust model.  Let's take
it as axiomatic that Trusted Identities are the common goal - after all the
internet is a dangerous place, and you can't spell "NSTIC" without Trusted
Identity.  If so, then defining what trust is and where it comes from is a
critical activity.

Trust is a much more pleasant word than risk, but they are closely
related.  We want Trusted Identities because we are aware of the dangers
that come from Risky Identities.  The relationship between trust and risk
is not a new idea, for instance this paper
<http://pdf.aminer.org/000/458/325/analysing_the_relationship_between_risk_and_trust.pdf>
 and this one
<http://aux.zicklin.baruch.cuny.edu/tkdas/publications/das-teng_jbp04_risktrust_85-116.pdf>
are
from 2004. The first paper defines trust as follows:

Definition 1 (Trust). Trust is the extent to which one party is willing to
depend on somebody, or something, in a given situation with a feeling of
relative security, even though negative consequences are possible

That paper quotes an earlier paper, characterizing a trust decision in the
following way:

“For example it is possible that the value of the damage per se (in case of
failure) is too high to choose a given decision branch, and this
independently either from the probability of the failure (even if it is
very low) or from the possible payoff (even if it is very high). In other
words, that danger might seem to the agent an intolerable risk.”

The paper also introduces a risk versus trust matrix that demonstrates and
clearly models the inverse relationship.  Higher levels of trust are
achieved through lower levels of risk.

*Vectors of Identity Risk*
Applying the idea of risk versus trust to the topic of this working group
may prove to be productive.  The vectors from the strawman were identity
proofing, credential strength, assertion strength, operational management,
etc.  What if we flip the dial on those metrics and describe them as risks.
The list becomes identity theft, credential compromise, assertion
subversion, backend hacking, etc.  Notice that each of those things can
have an estimated probability? At the large scale of transactions that
Relying Parties deal with, these probabilities add up to become statistics.

Each of those risks is truly a family of risks, of course. There are
different scenarios of identity theft, including impersonation by close
associate, impersonation through black market data, or impersonation
through forged physical identification.  All of those things happen, and
different implementations will be more or less susceptible to the different
scenarios. Likewise, different Relying Parties may have greater or lesser
tolerance to the varieties of risk.  For example, a Relying Party that
offers service to domestic abuse victims should use a scheme that is
strongly resistant to spousal identity theft.

The engineer crowd on this email list has discussed "vectors" in a
mathematical sense of variable values with multiple dimensions, but I want
to point out the medical sense of the term.  Instead of using a vector as a
measurement, we can think of it as a mechanism with associated metric.
Vectors of risk have a lot in common with vectors of disease, and just like
disease management requires control of disease vectors, achieving high
trust requires management and control of all of the risk vectors.  To
achieve trusted identities we must drain the swamp and minimize the vectors
of identity theft, credential forgery and other various threats that
prevent adoption of high value online identities.

*Credential Risk Scoring*
There are interesting parallels between this discussion and the concept of
vulnerability scoring.  Compare this group's first Strawman
<http://www.ietf.org/mail-archive/web/vot/current/msg00004.html> with the
Common Vulnerability Scoring System (CVSSv2
<http://www.first.org/cvss/cvss-guide>). These similarities appear because
credentials share many characteristics with vulnerabilities.  As described
above, credentials can be viewed as marginal increments of additional risk
to the Relying Party.  How much cumulative risk the RP has at the end
depends on the number of credentials and the risk to each one.

CVSSv2 defines three groups of vulnerability metrics:

   -
   - Base: intrinsic and fundamental characteristics of a vulnerability
   that are constant over time and environments, such as access vector, attack
   complexity, impact and authentication requirements.
   - Temporal: characteristics of a vulnerability that change over time but
   not among user environments, for example the availability of exploits and
   the availability of remediation
   - Environmental: characteristics of a vulnerability that are relevant to
   a particular environment, such as the potential damage, distribution of
   targets and local security requirements.

Applying these metrics to credential risk scores results in different sets
of metrics like:

   - Base: intrinsic characteristics of credentials that are constant over
   time and environments, such as number and strength of tokens, method of
   initial identity proofing, etc
   - Temporal: characteristics of credentials that change over time, for
   example the time since issuance and revocation status.
   - Environmental: characteristics of credentials that are relevant to a
   particular environment (i.e. to this particular RP), such as the potential
   damage of misused credentials, and distribution of assets that the
   credential can access.

The decision whether or not to trust a credential should be based on
consideration of each of those categories of risk.

I wanted to share these thoughts, but I don't quite have a conclusion.  I
would appreciate feedback on this way of looking at things, so please weigh
in with comments and critiques!

Thanks,
Scott

-- 
==============================================================
*Scott Shorter, Principal Security Engineer*
Electrosoft *–* Fueling Customer Success Through Outstanding Value and
Trust!
*Woman-Owned, Minority-Owned Small Business | ISO 9001 | CMMI Level 2 *
1893 Metro Center Drive; Ste 228; Reston, VA 20190
(703) 437-9451 x21 (office);   (240) 994-7793 (cell)
[email-masked] (Email);   http://www.electrosoft-inc.com (Web)
==============================================================