High-level Threat Models

A secure system should exhibit all the functionality that the system designer expects and no functionality that the designer doesn’t expect. Thus whether a system is secure depends on how principals—in particular how adversarial principals—interact with the system. This set of expected adversarial interactions is defined as the threat model. Threat models are characterized of the means, motivation, and opportunity of the attacker. The DoD Defense Science Board defines a hierarchy of threats ranging from socalled “script kiddies” to sophisticated nation states capable of introducing backdoor vulnerabilities into commercial products and combining sophisticated cyber attacks with military and/or intelligence activities: