From nobody Mon Dec 22 06:52:11 2014 Return-Path: X-Original-To: vot@ietfa.amsl.com Delivered-To: vot@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C6E041A900B for ; Mon, 22 Dec 2014 06:52:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.723 X-Spam-Level: X-Spam-Status: No, score=0.723 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qPI3SxAlD9Y6 for ; Mon, 22 Dec 2014 06:52:07 -0800 (PST) Received: from mail-lb0-f178.google.com (mail-lb0-f178.google.com [209.85.217.178]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39D351A8F4B for ; Mon, 22 Dec 2014 06:52:07 -0800 (PST) Received: by mail-lb0-f178.google.com with SMTP id f15so4518193lbj.9 for ; Mon, 22 Dec 2014 06:52:05 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to :content-type; bh=EDhy1R+0UOXv1pgZCe21KDCxH/7o9/OqEb3czZX2Zb8=; b=hFYnzWL+eKSmzxHWr7ZwWcv3NwwP4VK+oUVaqblnsAegXnGeAbnHABGcH8TYvMGg83 WRIYrxhcTRIkshfx6l7j40GqFrckwfvcP0lTr8qqsDdlvU49EEnPPp/O6LErBtRoy8kJ 579kpWq4gSav83oEUaJSQ7NkAXxcQziUFvEHwei3UQbi/iW9oTJConniElblIHMZ0JjL IXKKfxs3b3oe3CNsTACbSMzYO4Tnm8UroCTZizBxTOR9VyDUQ2dmRbnXpoAmyn92EsW3 +kuQLP69N3ZekrsbyCotlP6S/A3CghJ9SV3Y9xdkN7yjVuclSHU1ogBj/q2vS3zT+Qd6 SO4Q== X-Gm-Message-State: ALoCoQmzdVPiCUJXr3p/4AlY9O5G+4VH28SG8oekOsVYYapskyLBjP+SrAJ/Zn9c8dmbKv3OBQ5+ MIME-Version: 1.0 X-Received: by 10.152.23.98 with SMTP id l2mr22194473laf.46.1419259925245; Mon, 22 Dec 2014 06:52:05 -0800 (PST) Received: by 10.25.169.79 with HTTP; Mon, 22 Dec 2014 06:52:05 -0800 (PST) Date: Mon, 22 Dec 2014 09:52:05 -0500 Message-ID: From: Scott Shorter To: vot@ietf.org Content-Type: multipart/alternative; boundary=089e0158b7e4b04a1a050acf33ce Archived-At: http://mailarchive.ietf.org/arch/msg/vot/ZqCtSa93Yvt09VkkM4ZpLaqTWK8 Subject: [VoT] Some thoughts on vectors and trust X-BeenThere: vot@ietf.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Vectors of Trust discussion list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 22 Dec 2014 14:52:11 -0000 --089e0158b7e4b04a1a050acf33ce Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello list, I've lurked since early October, and appreciated the excellent discussions all around. After some digesting, I have some thoughts that I would appreciate feedback on: 1. Identity trust as inverse of identity risk (and application of the vectors concept to that model) 2. Proposed RP-centric trust/risk model for credentials 3. Proposed concept of credential scoring as a parallel to vulnerability scoring *Trust versus Risk* Trust is an important word to understand, and that understanding can be articulated and systematized through the use of a trust model. Let's take it as axiomatic that Trusted Identities are the common goal - after all the internet is a dangerous place, and you can't spell "NSTIC" without Trusted Identity. If so, then defining what trust is and where it comes from is a critical activity. Trust is a much more pleasant word than risk, but they are closely related. We want Trusted Identities because we are aware of the dangers that come from Risky Identities. The relationship between trust and risk is not a new idea, for instance this paper and this one are from 2004. The first paper defines trust as follows: Definition 1 (Trust). Trust is the extent to which one party is willing to depend on somebody, or something, in a given situation with a feeling of relative security, even though negative consequences are possible That paper quotes an earlier paper, characterizing a trust decision in the following way: =E2=80=9CFor example it is possible that the value of the damage per se (in= case of failure) is too high to choose a given decision branch, and this independently either from the probability of the failure (even if it is very low) or from the possible payoff (even if it is very high). In other words, that danger might seem to the agent an intolerable risk.=E2=80=9D The paper also introduces a risk versus trust matrix that demonstrates and clearly models the inverse relationship. Higher levels of trust are achieved through lower levels of risk. *Vectors of Identity Risk* Applying the idea of risk versus trust to the topic of this working group may prove to be productive. The vectors from the strawman were identity proofing, credential strength, assertion strength, operational management, etc. What if we flip the dial on those metrics and describe them as risks. The list becomes identity theft, credential compromise, assertion subversion, backend hacking, etc. Notice that each of those things can have an estimated probability? At the large scale of transactions that Relying Parties deal with, these probabilities add up to become statistics. Each of those risks is truly a family of risks, of course. There are different scenarios of identity theft, including impersonation by close associate, impersonation through black market data, or impersonation through forged physical identification. All of those things happen, and different implementations will be more or less susceptible to the different scenarios. Likewise, different Relying Parties may have greater or lesser tolerance to the varieties of risk. For example, a Relying Party that offers service to domestic abuse victims should use a scheme that is strongly resistant to spousal identity theft. The engineer crowd on this email list has discussed "vectors" in a mathematical sense of variable values with multiple dimensions, but I want to point out the medical sense of the term. Instead of using a vector as a measurement, we can think of it as a mechanism with associated metric. Vectors of risk have a lot in common with vectors of disease, and just like disease management requires control of disease vectors, achieving high trust requires management and control of all of the risk vectors. To achieve trusted identities we must drain the swamp and minimize the vectors of identity theft, credential forgery and other various threats that prevent adoption of high value online identities. *Credential Risk Scoring* There are interesting parallels between this discussion and the concept of vulnerability scoring. Compare this group's first Strawman with the Common Vulnerability Scoring System (CVSSv2 ). These similarities appear because credentials share many characteristics with vulnerabilities. As described above, credentials can be viewed as marginal increments of additional risk to the Relying Party. How much cumulative risk the RP has at the end depends on the number of credentials and the risk to each one. CVSSv2 defines three groups of vulnerability metrics: - - Base: intrinsic and fundamental characteristics of a vulnerability that are constant over time and environments, such as access vector, att= ack complexity, impact and authentication requirements. - Temporal: characteristics of a vulnerability that change over time but not among user environments, for example the availability of exploits an= d the availability of remediation - Environmental: characteristics of a vulnerability that are relevant to a particular environment, such as the potential damage, distribution of targets and local security requirements. Applying these metrics to credential risk scores results in different sets of metrics like: - Base: intrinsic characteristics of credentials that are constant over time and environments, such as number and strength of tokens, method of initial identity proofing, etc - Temporal: characteristics of credentials that change over time, for example the time since issuance and revocation status. - Environmental: characteristics of credentials that are relevant to a particular environment (i.e. to this particular RP), such as the potenti= al damage of misused credentials, and distribution of assets that the credential can access. The decision whether or not to trust a credential should be based on consideration of each of those categories of risk. I wanted to share these thoughts, but I don't quite have a conclusion. I would appreciate feedback on this way of looking at things, so please weigh in with comments and critiques! Thanks, Scott --=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *Scott Shorter, Principal Security Engineer* Electrosoft *=E2=80=93* Fueling Customer Success Through Outstanding Value = and Trust! *Woman-Owned, Minority-Owned Small Business | ISO 9001 | CMMI Level 2 * 1893 Metro Center Drive; Ste 228; Reston, VA 20190 (703) 437-9451 x21 (office); (240) 994-7793 (cell) sshorter@electrosoft-inc.com (Email); http://www.electrosoft-inc.com (Web= ) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --089e0158b7e4b04a1a050acf33ce Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hello list= ,

I've lurked since early October, a= nd appreciated the excellent discussions all around. After some digesting, = I have some thoughts that I would appreciate feedback on:

1. Identity trust as inverse of identity risk (and appli= cation of the vectors concept to that model)
2. Proposed RP-centric trust/risk model for credentia= ls=C2=A0
3. Proposed co= ncept of credential scoring as a parallel to vulnerability scoring

Trust ve= rsus Risk
Trust is an important word to understand, and that = understanding can be articulated and systematized through the use of a trus= t model.=C2=A0 Let's take it as axiomatic that Trusted Identities are t= he common goal - after all the internet is a dangerous place, and you can&#= 39;t spell "NSTIC" without Trusted Identity.=C2=A0 If so, then de= fining what trust is and where it comes from is a critical activity.
<= div>
Trust is a much more pleasant word than risk, but they a= re closely related.=C2=A0 We want Trusted Identities because we are aware o= f the dangers that come from Risky Identities.=C2=A0 The relationship betwe= en trust and risk is not a new idea, for instance=C2=A0this paper=C2=A0and=C2=A0this one=C2=A0are from 2004. The first paper defi= nes trust as follows:

= Definition 1 (Trust). Trust is the extent to which one party is willing to = depend on somebody, or something, in a given situation with a feeling of re= lative security, even though negative consequences are possible

That pa= per quotes an earlier paper, characterizing a trust decision in the followi= ng way:

=E2=80=9CFor e= xample it is possible that the value of the damage per se (in case of failu= re) is too high to choose a given decision branch, and this independently e= ither from the probability of the failure (even if it is very low) or from = the possible payoff (even if it is very high). In other words, that danger = might seem to the agent an intolerable risk.=E2=80=9D

The paper also introduces a risk versus trus= t matrix that demonstrates and clearly models the inverse relationship.=C2= =A0 Higher levels of trust are achieved through lower levels of risk.
=

Vectors of Identity Risk
Applying the idea of risk versus trus= t to the topic of this working group may prove to be productive.=C2=A0 The = vectors from the strawman were identity proofing, credential strength, asse= rtion strength, operational management, etc.=C2=A0 What if we flip the dial= on those metrics and describe them as risks. The list becomes identity the= ft, credential compromise, assertion subversion, backend hacking, etc.=C2= =A0 Notice that each of those things can have an estimated probability? At = the large scale of transactions that Relying Parties deal with, these proba= bilities add up to become statistics.

Eac= h of those risks is truly a family of risks, of course. There are different= scenarios of identity theft, including impersonation by close associate, i= mpersonation through black market data, or impersonation through forged phy= sical identification.=C2=A0 All of those things happen, and different imple= mentations will be more or less susceptible to the different scenarios. Lik= ewise, different Relying Parties may have greater or lesser tolerance to th= e varieties of risk.=C2=A0 For example, a Relying Party that offers service= to domestic abuse victims should use a scheme that is strongly resistant t= o spousal identity theft.

The engineer cr= owd on this email list has discussed "vectors" in a mathematical = sense of variable values with multiple dimensions, but I want to point out = the medical sense of the term.=C2=A0 Instead of using a vector as a measure= ment, we can think of it as a mechanism with associated metric.=C2=A0 Vecto= rs of risk have a lot in common with vectors of disease, and just like dise= ase management requires control of disease vectors, achieving high trust re= quires management and control of all of the risk vectors.=C2=A0 To achieve = trusted identities we must drain the swamp and minimize the vectors of iden= tity theft, credential forgery and other various threats that prevent adopt= ion of high value online identities.

C= redential Risk Scoring

  • Base= : intrinsic characteristics of credentials that are constant over time and = environments, such as number and strength of tokens, method of initial iden= tity proofing, etc
  • Temporal: characteristics of credentials tha= t change over time, for example the time since issuance and revocation stat= us.
  • Environmental: characteristics of cre= dentials that are relevant to a particular environment (i.e. to this partic= ular RP), such as the potential damage of misused credentials, and distribu= tion of assets that the credential can access.
<= div style=3D"color:rgb(0,0,0);font-size:13px">
The decision whether or not to tru= st a credential should be based on consideration of each of those categorie= s of risk.=C2=A0

I wanted to share these = thoughts, but I don't quite have a conclusion.=C2=A0 I would appreciate= feedback on this way of looking at things, so please weigh in with comment= s and critiques!

Thanks,
Scott

--
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
--089e0158b7e4b04a1a050acf33ce--