Threat Model Test Cases

Possible Information Attacks for Threat-Model Building

This is an aggregation of potential information-based attacks.

This list should always be growing.

These attacks should be considered when building a threat model for information defense.

General Information Attacks

1. Spying by communications and content delivery engines for sale to advertisers.
   1. Types of agencies (expand and reorganize)
      • Verizon, AT&T, Sprint, PCS,
      • Comcast, Sonic,
      • CDN Services
      • Internet level traffic (upstream of digital ocean)
      • Digital Ocean, AWS, storage and compute providers
2. Business Espionage
   1. Small business espionage
      • cryptolocker
   2. Big Business on Small Business
      • high level coordination between content storage services (gmail) and related companies (Alphabet) to use competitor data for markets of interest
        • Amazon, Google, Microsoft

Targeted Information Attacks

1. Device tampering
   1. Loss of control over physical device
   2. Organizations tampering with physical device before transfer of ownership
      • Lenovo + Superfish
      • Any government tampering
        • Intel ME
2. Coercive power
   1. Organizations are always in a legal jurisdiction
   2. Organizations have parent companies
      • Reddit + Conde Nast