search

mal-lang / coreLang

A probabilistic attack simulation language for the (abstract) IT domain
https://mal-lang.org/coreLang/
Other
10 stars 12 forks source link

Fix "Filtered" defence on the ConnectionRule #45

Closed andrewbwm closed 2 years ago

andrewbwm commented 3 years ago

Pull request has been opened.

46

andrewbwm commented 2 years ago

This has been fixed.

The pull request that solved this also introduced the concept of reverse reach. Reverse reach is the ability for the user to reach the attacker. It is particularly salient when discussing unsafe user actions. Some of the most impactful unsafe user actions are only relevant if the user has a way of reaching the attacker and therefore exposing the Applications to which they have access. The PayloadInspection defence precludes both the attacker from trigger vulnerabilities on the connected Applications and reverse reach, as the the payload inspection is expected to flag suspicious traffic in either direction.

Situations that do not require reverse reach are not currently implement but will probably be at least partially addressed in #60.

andrewbwm commented 2 years ago

Payload inspection is possible on encrypted communications in coreLang, something that is not possible in real life. This should be seen as incorrect modelling since we do not enforce it.