mal-lang / coreLang

A probabilistic attack simulation language for the (abstract) IT domain
https://mal-lang.org/coreLang/
Other
11 stars 13 forks source link

Assets for coreLang #1

Closed simonhacks closed 4 years ago

simonhacks commented 4 years ago
skatsikeas commented 4 years ago

Here are my notes for today:

Machines:

(Hardware) Machine Instance (Either physical or virtual) Networking Machine (e.g. Router, Firewall, etc.)

Data/Info:

Data Information (contained in Data or Connection or Machine)

User/IAM:

Account/Service Account User/Identity Role/Privilleges (because one service account could have many roles but only one user)

Network:

Network

Connection or Dataflow(?)

Network Clients & Servers

Software/Vulnerabilities:

Software (running on a Machine) Vulnerabilities (no need to be an asset, it will be an attack step on Machine/Software)


And some ideas on attack steps: A Machine could be discoverable (discover) instead of connectable (connect) Access could remain as is for legitimate access (leg. Access -> access) but We can have compromisedAccess for attacks