{ "@context": { "skos": "http://www.w3.org/2004/02/skos/core#", "dcterms": "http://purl.org/dc/terms/", "owl": "http://www.w3.org/2002/07/owl#", "xsd": "http://www.w3.org/2001/XMLSchema#", "rdf": "http://www.w3.org/1999/02/22-rdf-syntax-ns#", "rdfs": "http://www.w3.org/2000/01/rdf-schema#", "foaf": "http://xmlns.com/foaf/0.1/", "cc": "http://creativecommons.org/ns#", "ost": "https://ostering.com/ns/taxonomy#" }, "@graph": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/", "@type": "skos:ConceptScheme", "dcterms:title": { "@value": "Email Infrastructure Threat Taxonomy", "@language": "en-GB" }, "dcterms:alternative": { "@value": "The Unmodeled Attack Surface: A Threat Taxonomy for Email Infrastructure", "@language": "en-GB" }, "dcterms:description": { "@value": "125 entries in 10 groups. Each entry states a threat as a property of a component or a design decision, with the mitigation principle a sound design follows and concrete design measures. The reference for the card game Elevation of Email Flow; the reference (skos:notation) is shared with the game and is a stable identifier, not a severity.", "@language": "en-GB" }, "dcterms:creator": { "@id": "https://ostering.com/#brett-crawley" }, "dcterms:publisher": { "@id": "https://ostering.com/" }, "dcterms:issued": { "@value": "2026-10-26", "@type": "xsd:date" }, "owl:versionInfo": "1.0", "dcterms:license": { "@id": "https://creativecommons.org/licenses/by-nc-nd/4.0/" }, "cc:license": { "@id": "https://creativecommons.org/licenses/by-nc-nd/4.0/" }, "dcterms:rights": { "@value": "© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. Permission needed, by use: Sharing the whole taxonomy non-commercially (OWASP, universities, conferences, individuals): No; Threat modeling with it, including for paying clients: No; Internal use and training inside any organisation: No; Quoting entries, with credit, in paid courses, reports and talks: No; Shipping the taxonomy in a product: a tool's built-in library, a printed deck, a reprint for sale: Yes, ask me. Additional permissions: In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to: (1) use the taxonomy to threat model systems you build, operate or assess, including for paying clients; (2) use it internally, and for training, inside any organisation; (3) quote individual entries, with credit, in paid courses, reports, findings and talks. Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool's built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn. These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it.", "@language": "en-GB" }, "dcterms:rightsHolder": { "@id": "https://ostering.com/#brett-crawley" }, "cc:attributionName": "Jonathan Brett Crawley", "cc:attributionURL": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "dcterms:source": { "@id": "https://ostering.com/" }, "skos:hasTopConcept": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" } ] }, { "@id": "https://ostering.com/#brett-crawley", "@type": "foaf:Person", "foaf:name": "Jonathan Brett Crawley", "foaf:homepage": { "@id": "https://ostering.com/" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "DP", "skos:prefLabel": { "@value": "Delivery pipeline", "@language": "en-GB" }, "skos:definition": { "@value": "Every message should pass every control, in the intended order, and each control should see what the recipient will see. These entries cover sequencing, fracture and remediation across the hops between the sending MTA and the mailbox.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "The composition of hops between sending MTA and mailbox: sequencing, fracture, remediation", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-2" } ], "ost:position": 1, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·A", "skos:prefLabel": { "@value": "Ingress Bypass", "@language": "en-GB" }, "skos:definition": { "@value": "The platform exposes an endpoint that accepts mail for a recipient without it having passed the upstream controls the design assumes.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every ingress path enforces the same controls, bound to a verified identity rather than a network location.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Authenticate hybrid and partner ingress with mutual TLS or a per-connector client certificate, and reject sessions that present neither.", "@language": "en-GB" }, { "@value": "Route all ingress endpoints through one policy enforcement point, so an endpoint added later cannot skip a control by construction.", "@language": "en-GB" }, { "@value": "Inventory ingress endpoints from the network and load-balancer configuration, not from documentation, and alert when a listener appears that is not registered with the enforcement point.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/554.html" }, { "@id": "https://capec.mitre.org/data/definitions/36.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/554.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" }, { "@id": "https://cwe.mitre.org/data/definitions/291.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·K", "skos:prefLabel": { "@value": "Inherited Verdict", "@language": "en-GB" }, "skos:definition": { "@value": "A hop trusts a verdict, authentication result or classification written upstream that it cannot verify, including headers an external sender can forge.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A hop acts only on verdicts and authentication results it produced or can cryptographically verify.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Strip Authentication-Results, verdict and other platform headers at every ingress boundary before any inbound mail is processed.", "@language": "en-GB" }, { "@value": "Carry verdicts in out-of-band metadata keyed to the message (a queue envelope or database row), never in headers that travel with the message.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/194.html" }, { "@id": "https://capec.mitre.org/data/definitions/21.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/194.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, { "@id": "https://cwe.mitre.org/data/definitions/349.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·Q", "skos:prefLabel": { "@value": "Mutating Hop", "@language": "en-GB" }, "skos:definition": { "@value": "A hop rewrites the message (URLs, banners, footers, re-encoding), so downstream hops verify or scan something different from what was sent or what will be displayed.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A control inspects or verifies the exact bytes the recipient will receive, and any mutation is recorded with what it invalidated.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Verify DKIM and S/MIME signatures before any rewriting, and record the result in metadata the later hops and the client read.", "@language": "en-GB" }, { "@value": "Run content inspection on the post-mutation message, or make the mutating hop the last one before delivery.", "@language": "en-GB" }, { "@value": "Keep an immutable copy of the message as received, so that any later verification or investigation can be run against the original bytes.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/179.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/179.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·J", "skos:prefLabel": { "@value": "Fail-Open Scanning", "@language": "en-GB" }, "skos:definition": { "@value": "A scanner reaches a size, depth, time or decryption limit and the pipeline delivers the message anyway.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "\"Could not scan\" is a distinct outcome with its own policy, never silently collapsed into \"clean\".", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Return a distinct UNSCANNED verdict for every limit (size, depth, time, decryption) and map it to hold or a visible flag by default.", "@language": "en-GB" }, { "@value": "Make the fail-open or fail-closed choice a per-tenant policy setting with its default set to fail closed, and log every fail-open event.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/24.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/24.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·10", "skos:prefLabel": { "@value": "Verdict Decay", "@language": "en-GB" }, "skos:definition": { "@value": "A verdict is computed once on content whose meaning can change later, such as remote URLs and remotely loaded content.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Content whose meaning depends on resources outside the message is judged at the moment of use, not only at delivery.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Evaluate rewritten URLs at click time against current intelligence, and block or warn when the destination has changed since delivery.", "@language": "en-GB" }, { "@value": "Set a verdict lifetime for remote-dependent content and re-scan delivered messages when the lifetime expires or new intelligence arrives.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/29.html" }, { "@id": "https://cwe.mitre.org/data/definitions/367.html" }, { "@id": "https://cwe.mitre.org/data/definitions/638.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/29.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/367.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·9", "skos:prefLabel": { "@value": "Unscanned Path", "@language": "en-GB" }, "skos:definition": { "@value": "A write path to the mailbox exists that does not traverse the controls: internal and cross-tenant mail, API or IMAP APPEND injection, calendar items, connectors, migration and import.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "There is exactly one write path to the mailbox store, and every message takes it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Route intra-tenant, cross-tenant, API-submitted and IMAP APPEND messages through the same scanning pipeline as internet mail.", "@language": "en-GB" }, { "@value": "Remove direct write access to the store from every service except the delivery agent, and enforce that with the store's own authorisation.", "@language": "en-GB" }, { "@value": "Test the single-path property continuously by injecting marked messages through every write interface (API, IMAP APPEND, calendar, import, migration) and asserting that each one appears in the scanner's log.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/554.html" }, { "@id": "https://capec.mitre.org/data/definitions/36.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/554.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·8", "skos:prefLabel": { "@value": "Remediation Race", "@language": "en-GB" }, "skos:definition": { "@value": "Post-delivery retraction assumes the platform still controls every copy, but synced devices, forwards, rules and API consumers have already taken one.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Remediation reaches every copy the platform created and reports the copies it could not reach.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Track each copy made by sync, forward, rule or API with the message identifier, so remediation can target each one.", "@language": "en-GB" }, { "@value": "Return a remediation report listing unreachable copies (offline devices, external forwards) so the tenant can act on them.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·7", "skos:prefLabel": { "@value": "Tenant Confusion", "@language": "en-GB" }, "skos:definition": { "@value": "A shared hop attributes a message to a tenant from an attribute the sender controls, or applies one tenant's configuration, trusted status or allow list to another tenant's mail.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Tenant identity is resolved from a verified property, bound to the message at ingress, and every later decision is scoped by it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Attribute a message to a tenant only from a verified property (a per-tenant client certificate for connectors, the verified recipient domain for inbound mail), never from the envelope sender or an IP address that a third party shares.", "@language": "en-GB" }, { "@value": "Store allow lists, connectors and trusted-sender rules keyed by tenant identifier, reject lookups that supply none, and never let attribution alone confer internal or trusted status.", "@language": "en-GB" }, { "@value": "Carry the tenant identifier in internal metadata outside the message, and have every service reject a message whose metadata is missing or whose tenant does not match the recipient domain.", "@language": "en-GB" }, { "@value": "Test tenancy with two tenants on the same shared IP range and the same sender domain, and assert that neither's configuration affects the other's mail.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/21.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/21.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, { "@id": "https://cwe.mitre.org/data/definitions/291.html" }, { "@id": "https://cwe.mitre.org/data/definitions/639.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·6", "skos:prefLabel": { "@value": "Induced Backpressure", "@language": "en-GB" }, "skos:definition": { "@value": "A sender drives load so that queues, deferrals or timeouts cause controls to be skipped or shortened.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Controls degrade to hold or defer under load, never to skip.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reserve per-tenant queue and scanner capacity so one sender cannot consume what others need.", "@language": "en-GB" }, { "@value": "Defer with a 4xx response when scanner capacity is exhausted, rather than accepting and delivering unscanned.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/125.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/125.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, { "@id": "https://cwe.mitre.org/data/definitions/770.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·5", "skos:prefLabel": { "@value": "Loop and Amplification", "@language": "en-GB" }, "skos:definition": { "@value": "Forwarding, auto-replies and bounces between hops create loops or multiply mail.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Automatic mail is rate-limited and loop-detected on every path that can generate it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Count the platform's own trace headers and refuse to forward or reply once a hop limit is reached.", "@language": "en-GB" }, { "@value": "Rate-limit auto-replies and automatic forwards per recipient and per trigger, and suppress them for mail that failed authentication.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/490.html" }, { "@id": "https://cwe.mitre.org/data/definitions/406.html" }, { "@id": "https://cwe.mitre.org/data/definitions/799.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/490.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/406.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·4", "skos:prefLabel": { "@value": "Verdict Inconsistency", "@language": "en-GB" }, "skos:definition": { "@value": "One message to several recipients is split, scanned or cached differently per recipient, and a cached verdict is reused where it does not apply.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "One message produces one verdict per recipient policy, and cached verdicts are keyed on everything they depend on.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Key the verdict cache on the full content hash plus the sender identity, authentication result and tenant policy version.", "@language": "en-GB" }, { "@value": "Scan a split message once and attach the single verdict to every recipient copy, then apply per-recipient policy to that verdict.", "@language": "en-GB" }, { "@value": "Invalidate cached verdicts when the policy, the intelligence feed or the scanner version changes, not only when the content hash does.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/141.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1023.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1250.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/141.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1023.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·3", "skos:prefLabel": { "@value": "Quarantine Release Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Quarantine, release and allow-list paths return a message to the mailbox without re-evaluating it.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A message leaving quarantine is re-evaluated with current intelligence, and release requires authenticated intent.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Re-scan on release and refuse to deliver if the current verdict is worse than at quarantine time.", "@language": "en-GB" }, { "@value": "Require an authenticated session for release, with single-use tokens for digest links and no release via GET.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/62.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" }, { "@id": "https://cwe.mitre.org/data/definitions/841.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/62.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/424.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/#dp-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" }, "skos:notation": "DP·2", "skos:prefLabel": { "@value": "Pipeline Reconfiguration", "@language": "en-GB" }, "skos:definition": { "@value": "Whoever can change routing rules, connectors or transport rules can steer mail around the controls, and the change looks like ordinary administration.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Changes to the path a message takes are privileged, approved and traceable to the message.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Require a second approver for any routing, connector or transport rule change that removes a control from the path.", "@language": "en-GB" }, { "@value": "Record the ordered list of controls each delivered message traversed, and alert when a message's path differs from the tenant's baseline.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/176.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/176.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1220.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/1220.html" }, { "@id": "https://cwe.mitre.org/data/definitions/778.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "AU", "skos:prefLabel": { "@value": "Authentication protocols", "@language": "en-GB" }, "skos:definition": { "@value": "SPF, DKIM, DMARC and ARC prove which domain handled a message, and the danger is that a pass is read as more than it means. These entries treat the protocols as trust signals that can be weaponised, in both the signing and the verifying role.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "SPF, DKIM, DMARC and ARC as trust signals that can be weaponised", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-2" } ], "ost:position": 2, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·A", "skos:prefLabel": { "@value": "Pass as Endorsement", "@language": "en-GB" }, "skos:definition": { "@value": "The platform treats an authentication pass as a trust signal (filter bypass, reputation boost, a badge), though any attacker-owned domain can pass.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "An authentication pass asserts the sending domain and nothing else.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Feed authentication results only into DMARC disposition and domain reputation, never into filter bypass, score reduction or trust badges.", "@language": "en-GB" }, { "@value": "Evaluate domain reputation (age, history, similarity to known domains) as a separate input that an authentication pass cannot raise.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/654.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/654.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·K", "skos:prefLabel": { "@value": "Cross-Tenant Identity", "@language": "en-GB" }, "skos:definition": { "@value": "Shared sending infrastructure lets one tenant emit mail that authenticates as another tenant's domain.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Each tenant can authenticate only for domains it has proven it owns, and a shared upstream identifies its customers by something they cannot set.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject submission when the envelope sender or From domain is not in the tenant's verified domain list, and when accepting outbound mail from a shared upstream, identify the customer from a property that upstream stamps and the sender cannot forge (a tenant identifier header or a per-tenant certificate), never from the connecting IP.", "@language": "en-GB" }, { "@value": "Issue DKIM keys per tenant and per domain, and never sign a message with a key belonging to another tenant.", "@language": "en-GB" }, { "@value": "Audit outbound mail per tenant against that tenant's verified domains, and alert on any signed message whose domain the tenant does not own.", "@language": "en-GB" }, { "@value": "Give each tenant on a shared upstream its own inbound connector with its own certificate, so a tenant cannot present itself as another even to the upstream.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/151.html" }, { "@id": "https://capec.mitre.org/data/definitions/195.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/151.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, { "@id": "https://cwe.mitre.org/data/definitions/291.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·Q", "skos:prefLabel": { "@value": "DKIM Replay", "@language": "en-GB" }, "skos:definition": { "@value": "A message the platform signed is re-sent to arbitrary recipients, because the signature binds neither recipient nor time.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A DKIM signature binds a message to its intended recipients and a time window.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Sign the To, Cc and Date headers, oversign them, and set a short expiry (x= tag) on every signature.", "@language": "en-GB" }, { "@value": "Limit the signing of mail from new, free or unverified accounts, and detect replay by rate-limiting identical signed messages per signature.", "@language": "en-GB" }, { "@value": "Monitor for the platform's own signatures appearing on mail that did not pass through its outbound path (a DKIM replay feed or recipient reports), and revoke the selector when replay is detected.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/60.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/60.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/294.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/294.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·J", "skos:prefLabel": { "@value": "Partial Signature Coverage", "@language": "en-GB" }, "skos:definition": { "@value": "The signer leaves headers or body unsigned, or the verifier honours l= and tolerates duplicate headers, so content changes under a valid signature.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A signature covers everything the recipient will see, and the verifier treats partial coverage as unsigned.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Sign and oversign From, To, Subject, Date, Reply-To, Content-Type and MIME-Version; do not use the l= tag when signing.", "@language": "en-GB" }, { "@value": "As a verifier, treat l= signatures and duplicated single-instance headers as a DKIM failure.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/477.html" }, { "@id": "https://cwe.mitre.org/data/definitions/349.html" }, { "@id": "https://cwe.mitre.org/data/definitions/347.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/477.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/349.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·10", "skos:prefLabel": { "@value": "Alignment Confusion", "@language": "en-GB" }, "skos:definition": { "@value": "The identifier that authentication verified is not the one the client displays: a second From header, a Sender or Resent-From standing in for a missing From, or a display name is shown while the evaluator checked something else.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "One identifier is authenticated, and the client displays only that identifier, parsed the same way.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject at SMTP time any message with no From header, more than one, or one that does not parse.", "@language": "en-GB" }, { "@value": "Share one address-parsing library between the DMARC evaluator and every client, tested against the same corpus of malformed headers, and never show Sender, Resent-From or a display name in place of the authenticated From.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" }, { "@id": "https://capec.mitre.org/data/definitions/476.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·9", "skos:prefLabel": { "@value": "Identifier Handoff", "@language": "en-GB" }, "skos:definition": { "@value": "An authentication check silently substitutes one identifier for another: SPF verifies the HELO name because MAIL FROM is empty or does not resolve, and DMARC then aligns that pass against the MAIL FROM it never checked.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every authentication result names the identifier it verified, and no result is applied to an identifier it did not check.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Record the checked identifier (HELO or MAIL FROM) in the SPF result, and have DMARC treat an SPF pass on HELO as no SPF result for MAIL FROM alignment.", "@language": "en-GB" }, { "@value": "Handle an empty or unresolvable MAIL FROM as a case of its own with an explicit policy rather than a silent substitution, and test the evaluator with messages engineered to make the preferred identifier fail.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/475.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1390.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/475.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1390.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·8", "skos:prefLabel": { "@value": "Laundered Trust", "@language": "en-GB" }, "skos:definition": { "@value": "Forwarders, mailing lists and ARC seals from untrustworthy intermediaries override an authentication failure.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Only sealers the platform has deliberately trusted can override an authentication failure.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Maintain a short, reviewed list of trusted ARC sealers, and ignore ARC results from any sealer not on it.", "@language": "en-GB" }, { "@value": "Alert when a trusted sealer's override rate changes sharply, and have a procedure to remove a sealer within hours.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/21.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/21.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/807.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·7", "skos:prefLabel": { "@value": "Weak or Shared Keys", "@language": "en-GB" }, "skos:definition": { "@value": "Signing keys are short, shared across tenants, never rotated, or their selectors are never retired.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Signing keys are strong, per tenant, rotated, and retired when their selectors are.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Generate 2048-bit RSA or Ed25519 keys per tenant and domain, and store them in an HSM or key management service.", "@language": "en-GB" }, { "@value": "Rotate keys on a fixed schedule with dual selectors, and remove the retired selector's DNS record after the rotation window.", "@language": "en-GB" }, { "@value": "Record every signing operation against the tenant and key that performed it, and alert on a key used for a domain it was not issued for.", "@language": "en-GB" }, { "@value": "Keep an inventory of published selectors per domain and remove any whose key is no longer in the key store.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/485.html" }, { "@id": "https://capec.mitre.org/data/definitions/474.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/485.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/326.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/326.html" }, { "@id": "https://cwe.mitre.org/data/definitions/324.html" }, { "@id": "https://cwe.mitre.org/data/definitions/653.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·6", "skos:prefLabel": { "@value": "Error as Pass", "@language": "en-GB" }, "skos:definition": { "@value": "Temporary and permanent evaluation errors (lookup limits, timeouts, malformed records) are treated as neutral or pass, and a sender can induce them.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "An authentication error has its own disposition, never silently mapped to pass or none.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Treat temperror as defer and permerror as fail for domains with a published policy.", "@language": "en-GB" }, { "@value": "Log the error class in Authentication-Results and expose it as a distinct input to downstream policy and scoring.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/115.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/115.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·5", "skos:prefLabel": { "@value": "Policy Override", "@language": "en-GB" }, "skos:definition": { "@value": "Local allow lists, exemptions or softened dispositions silently void the domain owner's published policy.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The domain owner's published policy is overridden only by an explicit, scoped and visible exception.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Enforce DMARC reject and quarantine before allow lists are consulted, and make any exemption a per-sender, time-limited rule.", "@language": "en-GB" }, { "@value": "Report overridden dispositions to the domain owner in aggregate reports, and show the tenant admin a list of active overrides.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/183.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/183.html" }, { "@id": "https://cwe.mitre.org/data/definitions/696.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·4", "skos:prefLabel": { "@value": "Signing Oracle", "@language": "en-GB" }, "skos:definition": { "@value": "The platform signs content it did not originate, such as forwards, bounces, auto-replies and notifications carrying attacker-chosen content.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform signs only content that originates from an authenticated sender it is authorised for.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Do not sign auto-forwards, bounces or notifications that carry third-party content with a tenant's domain; use a dedicated subdomain with its own policy instead.", "@language": "en-GB" }, { "@value": "Strip or quote attacker-controlled content in auto-replies and notifications to what is needed for the recipient to act.", "@language": "en-GB" }, { "@value": "Rate-limit automatic mail per account and per trigger, and refuse to sign automatic mail whose content exceeds a size or structure budget.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/441.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/441.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·3", "skos:prefLabel": { "@value": "Signal Stripping", "@language": "en-GB" }, "skos:definition": { "@value": "Removing a signature or a record downgrades evaluation to a weaker path instead of raising suspicion.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The absence of an expected signal is a failure, not a downgrade.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Record per sending domain whether it normally signs, and treat an unsigned message from a signing domain as a DKIM failure.", "@language": "en-GB" }, { "@value": "Require DKIM alignment, not SPF alone, for domains whose history shows consistent signing.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/620.html" }, { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, { "@id": "https://cwe.mitre.org/data/definitions/757.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/620.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/#au-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" }, "skos:notation": "AU·2", "skos:prefLabel": { "@value": "Report Channel Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Aggregate and failure reports leak message data, go to unverified destinations, or are used for amplification.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Reports go only to verified destinations, contain only what is needed, and are rate-limited.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Check the external destination verification record before sending any report to a different domain.", "@language": "en-GB" }, { "@value": "Redact message bodies from failure reports, and cap the number of reports sent per domain per hour.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/490.html" }, { "@id": "https://cwe.mitre.org/data/definitions/201.html" }, { "@id": "https://cwe.mitre.org/data/definitions/406.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/490.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/201.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "CP", "skos:prefLabel": { "@value": "Client protocols", "@language": "en-GB" }, "skos:definition": { "@value": "Client access is where a mailbox is read, copied and reconfigured, so a weakness here exposes everything the rest of the platform protected. These entries cover IMAP, POP and SMTP submission, plus EWS, ActiveSync, JMAP and vendor APIs.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "IMAP, POP, submission, and the API protocols clients use to reach the mailbox", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-2" } ], "ost:position": 3, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·A", "skos:prefLabel": { "@value": "Legacy Authentication", "@language": "en-GB" }, "skos:definition": { "@value": "Protocol endpoints accept password-only authentication that bypasses MFA and access policy.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every protocol endpoint enforces the same authentication and access policy as the web login.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Disable password-only and app-password authentication by default, and require OAuth or a device-bound credential on IMAP, POP and submission.", "@language": "en-GB" }, { "@value": "Evaluate conditional access (MFA, device, location) at the protocol gateway, not only at the web login.", "@language": "en-GB" }, { "@value": "Report per tenant which accounts still use legacy authentication and give the tenant a date-driven path to retire it, with telemetry on what would break.", "@language": "en-GB" }, { "@value": "Treat an authentication through a legacy protocol as a lower-assurance session with reduced rights (read-only, no rule changes, no export).", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/115.html" }, { "@id": "https://capec.mitre.org/data/definitions/565.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/115.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/420.html" }, { "@id": "https://cwe.mitre.org/data/definitions/308.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·K", "skos:prefLabel": { "@value": "Credential Exposure in Transit", "@language": "en-GB" }, "skos:definition": { "@value": "STARTTLS stripping, commands injected before the TLS upgrade, or cleartext fallback expose credentials.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Credentials are never accepted on a connection that is not already encrypted.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Offer implicit TLS ports only (993, 995, 465) and remove STARTTLS listeners for authentication.", "@language": "en-GB" }, { "@value": "If STARTTLS must be kept, discard any input buffered before the TLS handshake and reject AUTH before the upgrade.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/620.html" }, { "@id": "https://capec.mitre.org/data/definitions/157.html" }, { "@id": "https://cwe.mitre.org/data/definitions/319.html" }, { "@id": "https://cwe.mitre.org/data/definitions/523.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/620.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/319.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·Q", "skos:prefLabel": { "@value": "Token and Session Persistence", "@language": "en-GB" }, "skos:definition": { "@value": "Tokens and sessions are over-scoped, unbound to a device, or survive a password reset.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A credential change revokes every token and session, and tokens are bound to what they were issued to.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Revoke refresh tokens and active sessions on password reset, account disable and MFA change, propagating within minutes.", "@language": "en-GB" }, { "@value": "Bind tokens to the client (DPoP or mTLS) and scope them to the narrowest mail permission the client needs.", "@language": "en-GB" }, { "@value": "Expire sessions and tokens on an absolute lifetime as well as an idle one, and re-check account state (disabled, held, reset) on every token refresh.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/60.html" }, { "@id": "https://capec.mitre.org/data/definitions/593.html" }, { "@id": "https://cwe.mitre.org/data/definitions/613.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1220.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/60.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/613.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·J", "skos:prefLabel": { "@value": "Sync as Exfiltration", "@language": "en-GB" }, "skos:definition": { "@value": "Full mailbox replication by a new client is indistinguishable from normal use.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A new client's first full sync is visible and can be limited.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Notify the mailbox owner and tenant admin when a new client authenticates, and show its first-sync volume in the audit log.", "@language": "en-GB" }, { "@value": "Allow tenants to limit unmanaged clients to recent mail and to require approval for full-mailbox sync.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/778.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/778.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·10", "skos:prefLabel": { "@value": "Mailbox State Manipulation", "@language": "en-GB" }, "skos:definition": { "@value": "Rules, forwarding, delegation or appended messages are set through the protocol without any signal to the owner.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Any change to how a mailbox routes or shares mail is notified to its owner.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Send an out-of-band notification (push or SMS) when a rule, forward or delegate is created through any protocol.", "@language": "en-GB" }, { "@value": "Block external auto-forwarding rules by default and require admin approval per rule.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Repudiation" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/176.html" }, { "@id": "https://cwe.mitre.org/data/definitions/223.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1188.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/176.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/223.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·9", "skos:prefLabel": { "@value": "Credentials and Caches at Rest", "@language": "en-GB" }, "skos:definition": { "@value": "Clients and intermediary services store credentials and mailbox copies outside the platform's control.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform controls where its credentials and mail copies end up.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Issue short-lived tokens so no client holds a long-lived secret, and refuse third-party intermediaries that store user credentials.", "@language": "en-GB" }, { "@value": "Support remote wipe of client caches and enforce it through device-management APIs for managed clients.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/37.html" }, { "@id": "https://capec.mitre.org/data/definitions/204.html" }, { "@id": "https://cwe.mitre.org/data/definitions/522.html" }, { "@id": "https://cwe.mitre.org/data/definitions/524.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/37.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/522.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·8", "skos:prefLabel": { "@value": "Autodiscovery Hijack", "@language": "en-GB" }, "skos:definition": { "@value": "Client configuration discovery sends credentials to an unintended or attacker-controlled host.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A client sends credentials only to a host it has verified belongs to the mailbox provider.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Publish autodiscovery over HTTPS only, and have clients verify the certificate and domain match before sending any credential.", "@language": "en-GB" }, { "@value": "Fail closed: when the expected discovery host does not resolve, prompt the user rather than trying alternative hostnames.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/154.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/154.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/923.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/923.html" }, { "@id": "https://cwe.mitre.org/data/definitions/941.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·7", "skos:prefLabel": { "@value": "Authentication Oracle", "@language": "en-GB" }, "skos:definition": { "@value": "Differing responses or timing allow account enumeration and password spraying, with throttling inconsistent across protocols.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Authentication responses and limits are uniform across users, errors and protocols.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Return an identical response and timing for unknown user, wrong password and locked account.", "@language": "en-GB" }, { "@value": "Share the throttling and lockout counters across IMAP, POP, submission, API and web login.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/575.html" }, { "@id": "https://capec.mitre.org/data/definitions/565.html" }, { "@id": "https://capec.mitre.org/data/definitions/49.html" }, { "@id": "https://cwe.mitre.org/data/definitions/204.html" }, { "@id": "https://cwe.mitre.org/data/definitions/208.html" }, { "@id": "https://cwe.mitre.org/data/definitions/307.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/575.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/204.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·6", "skos:prefLabel": { "@value": "Third-Party Delegation", "@language": "en-GB" }, "skos:definition": { "@value": "App consent grants broad, durable mailbox access that the owner cannot easily see or revoke.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Third-party access is narrowly scoped, visible to the owner and revocable in one place.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Offer granular mail scopes (read recent, send only, folder-limited) and require admin consent for full-mailbox scopes.", "@language": "en-GB" }, { "@value": "Give users and admins a single page listing every app with mailbox access, with one-click revocation.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/122.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1220.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/122.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1220.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·5", "skos:prefLabel": { "@value": "Cross-Mailbox Access", "@language": "en-GB" }, "skos:definition": { "@value": "Shared folders, delegation or impersonation features allow access beyond the authenticated identity.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Authorisation is checked on every object, on every request, against the authenticated identity.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Use per-mailbox, unguessable object identifiers and check ownership on every fetch, not only when listing.", "@language": "en-GB" }, { "@value": "Restrict impersonation rights to specific service accounts, log every impersonated request, and alert on impersonation of privileged users.", "@language": "en-GB" }, { "@value": "Test authorisation with an automated suite that requests every object type as a different user, a different tenant and a delegate, and fails the build on any success.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/1.html" }, { "@id": "https://capec.mitre.org/data/definitions/180.html" }, { "@id": "https://cwe.mitre.org/data/definitions/863.html" }, { "@id": "https://cwe.mitre.org/data/definitions/639.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/1.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/863.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·4", "skos:prefLabel": { "@value": "Protocol Command Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Malformed or expensive commands (literals, searches, large fetches) cause injection or resource exhaustion on the server.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every command is bounded, isolated per user and never interpolated into a backend query.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Cap command length, literal size, search complexity and concurrent connections per session and per user.", "@language": "en-GB" }, { "@value": "Pass search terms as parameters to the index, never by string concatenation, and run searches with a per-tenant resource budget.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/183.html" }, { "@id": "https://capec.mitre.org/data/definitions/130.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/183.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/770.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/770.html" }, { "@id": "https://cwe.mitre.org/data/definitions/943.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·3", "skos:prefLabel": { "@value": "Lockout as Denial of Service", "@language": "en-GB" }, "skos:definition": { "@value": "An attacker who knows a username can lock the account on demand by failing authentication deliberately, cutting the target off from mail at a moment of the attacker's choosing.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Lockout protects the account without handing an attacker an off switch.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Lock out the source (address, device, session) rather than the account, and escalate to a risk-based challenge for the account itself.", "@language": "en-GB" }, { "@value": "Keep already-authenticated sessions alive through a lockout and give the mailbox owner a trusted recovery path that does not depend on the locked credential.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/2.html" }, { "@id": "https://cwe.mitre.org/data/definitions/645.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/2.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/645.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/#cp-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/client-protocols/" }, "skos:notation": "CP·2", "skos:prefLabel": { "@value": "Notification Leakage", "@language": "en-GB" }, "skos:definition": { "@value": "Push notifications and previews expose message content to third-party services and lock screens.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Notification payloads contain nothing the recipient would not want on a lock screen or a third-party server.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Send content-free push alerts and have the client fetch the preview over an authenticated channel.", "@language": "en-GB" }, { "@value": "Let tenants disable previews and sender names in notifications for sensitive mailboxes.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/201.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/201.html" }, { "@id": "https://cwe.mitre.org/data/definitions/359.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "SM", "skos:prefLabel": { "@value": "SMTP", "@language": "en-GB" }, "skos:definition": { "@value": "SMTP accepts whatever identity a peer asserts and secures each hop only if both ends insist. These entries cover the MTA-to-MTA conversation: identity, relay, transport security and parsing.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "The MTA-to-MTA conversation: identity, relay, transport security, parsing", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-2" } ], "ost:position": 4, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·A", "skos:prefLabel": { "@value": "Unauthenticated Identity Assertion", "@language": "en-GB" }, "skos:definition": { "@value": "The server accepts any claimed envelope sender, header From and HELO identity.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Asserted identities are recorded but never acted on until something verifiable confirms them.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Base connector, routing and trust decisions on a verified property (authenticated session, client certificate, DKIM-aligned domain), never on HELO, PTR or envelope sender alone.", "@language": "en-GB" }, { "@value": "Treat a mismatch between HELO, PTR and connecting IP as a risk signal rather than an identity.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/194.html" }, { "@id": "https://capec.mitre.org/data/definitions/151.html" }, { "@id": "https://cwe.mitre.org/data/definitions/346.html" }, { "@id": "https://cwe.mitre.org/data/definitions/807.html" }, { "@id": "https://cwe.mitre.org/data/definitions/350.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/194.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/346.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·K", "skos:prefLabel": { "@value": "Relay Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Open relays, permissive connectors or trusted-IP rules let others send through the platform.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Relay is granted to authenticated identities, never to network locations.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Require SMTP AUTH or a client certificate for any relay to a domain the platform does not host.", "@language": "en-GB" }, { "@value": "Review relay rules automatically and alert when a rule covers a shared cloud range or more than a small number of addresses.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/212.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/212.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/441.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/441.html" }, { "@id": "https://cwe.mitre.org/data/definitions/291.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·Q", "skos:prefLabel": { "@value": "TLS Downgrade", "@language": "en-GB" }, "skos:definition": { "@value": "STARTTLS is stripped or certificates go unvalidated, exposing mail in transit.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Transport security is enforced where the peer demands it and verified where the platform can.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Honour MTA-STS and DANE on outbound delivery, deferring rather than falling back to cleartext when the policy requires TLS.", "@language": "en-GB" }, { "@value": "Publish an MTA-STS policy in enforce mode and TLS-RPT for the platform's own domains.", "@language": "en-GB" }, { "@value": "Verify the peer's certificate chain and hostname for every outbound session, and report the result in TLS-RPT and in a per-domain delivery dashboard.", "@language": "en-GB" }, { "@value": "Require TLS 1.2 or later with a modern cipher list on both inbound and outbound, and record the negotiated version per session for audit.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/620.html" }, { "@id": "https://capec.mitre.org/data/definitions/94.html" }, { "@id": "https://capec.mitre.org/data/definitions/217.html" }, { "@id": "https://cwe.mitre.org/data/definitions/319.html" }, { "@id": "https://cwe.mitre.org/data/definitions/295.html" }, { "@id": "https://cwe.mitre.org/data/definitions/757.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/620.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/319.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·J", "skos:prefLabel": { "@value": "SMTP Smuggling", "@language": "en-GB" }, "skos:definition": { "@value": "Two MTAs disagree on the end-of-data sequence, letting a sender inject a second message with a forged envelope.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Both ends of every SMTP hop agree on where a message ends.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Accept only CRLF.CRLF as end of data, and reject or normalise bare CR and bare LF on input and output.", "@language": "en-GB" }, { "@value": "Test every MTA pair in the path against each other's handling of non-standard line endings and include the test in release checks.", "@language": "en-GB" }, { "@value": "Close the session, rather than accepting the data, when the end-of-data sequence is ambiguous, and log the peer for follow-up.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/33.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/33.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, { "@id": "https://cwe.mitre.org/data/definitions/147.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·10", "skos:prefLabel": { "@value": "Recipient Enumeration", "@language": "en-GB" }, "skos:definition": { "@value": "Recipient responses, their timing or later bounces reveal which addresses exist, so an attacker can harvest a tenant's directory.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Invalid recipients are refused in session, uniformly, and probing is rate-limited.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject unknown recipients at RCPT TO with the same response and timing as valid-but-throttled ones.", "@language": "en-GB" }, { "@value": "Disable VRFY and EXPN and rate-limit RCPT failures per connecting IP and per sender.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/575.html" }, { "@id": "https://cwe.mitre.org/data/definitions/204.html" }, { "@id": "https://cwe.mitre.org/data/definitions/208.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/575.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/204.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·9", "skos:prefLabel": { "@value": "Command and Header Injection", "@language": "en-GB" }, "skos:definition": { "@value": "A metacharacter in an address, domain or field reaches a component that composes SMTP commands, message headers or the platform's own Authentication-Results, and is read as structure rather than data.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "No input can change the structure of a command, header or result the platform composes.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject CR, LF, parentheses, quotes and other delimiter characters in every address, domain, subject and custom header value at the boundary where it enters the platform.", "@language": "en-GB" }, { "@value": "Compose messages, commands and Authentication-Results with a library that encodes values as data, forbid string concatenation in code review and linting, and have the DMARC evaluator read results from a typed internal record rather than by re-parsing the header.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/134.html" }, { "@id": "https://capec.mitre.org/data/definitions/41.html" }, { "@id": "https://capec.mitre.org/data/definitions/183.html" }, { "@id": "https://cwe.mitre.org/data/definitions/93.html" }, { "@id": "https://cwe.mitre.org/data/definitions/116.html" }, { "@id": "https://cwe.mitre.org/data/definitions/77.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/134.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/93.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·8", "skos:prefLabel": { "@value": "Shared Reputation Poisoning", "@language": "en-GB" }, "skos:definition": { "@value": "One tenant's abuse burns the shared IP addresses and domains every tenant sends from.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Outbound reputation is segmented so one tenant's abuse cannot burn another's.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Start new and unverified tenants on a separate IP pool, and promote them to shared pools only after a clean sending history.", "@language": "en-GB" }, { "@value": "Detect abusive sending within minutes (bounce rate, complaint rate, volume spikes) and move the tenant to an isolated pool automatically.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/653.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/653.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·7", "skos:prefLabel": { "@value": "Submission Identity Mismatch", "@language": "en-GB" }, "skos:definition": { "@value": "An authenticated submitter can send with a From or envelope sender that is not theirs.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A submitted identity is checked against what the authenticated user may use.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Verify that From and envelope sender match the authenticated user's own addresses or an explicitly granted send-as right.", "@language": "en-GB" }, { "@value": "Record send-as and send-on-behalf grants as auditable permissions and show them to the mailbox owner.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/195.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/195.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/862.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/862.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·6", "skos:prefLabel": { "@value": "Resource Exhaustion", "@language": "en-GB" }, "skos:definition": { "@value": "Connection floods, slow senders, queue filling and mail bombing degrade or stop delivery.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Resources are limited per peer, per sender and per tenant so that volume against one cannot stop delivery for all.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Set connection, rate and queue limits per connecting IP, per sender domain and per recipient, with separate tenant queue capacity.", "@language": "en-GB" }, { "@value": "Detect mail bombing by recipient-level volume anomalies and divert the excess to a holding queue rather than the inbox.", "@language": "en-GB" }, { "@value": "Keep a separate, protected ingress path for mail from known-good senders and for tenant-critical flows (authentication codes, alerts) so that a flood cannot delay them.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/125.html" }, { "@id": "https://capec.mitre.org/data/definitions/227.html" }, { "@id": "https://capec.mitre.org/data/definitions/130.html" }, { "@id": "https://cwe.mitre.org/data/definitions/770.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/125.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/770.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·5", "skos:prefLabel": { "@value": "Trace Forgery", "@language": "en-GB" }, "skos:definition": { "@value": "Received headers are forged or stripped while platform decisions or forensics rely on them.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Only trace records the platform wrote are used for decisions, and the boundary is unambiguous.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Mark the platform's own Received headers with a verifiable token and ignore any trace header below the first one the platform wrote.", "@language": "en-GB" }, { "@value": "Keep the platform's routing and forensic records in its own logs, keyed to the message, not in the message.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Repudiation" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/93.html" }, { "@id": "https://capec.mitre.org/data/definitions/194.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/93.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/349.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/349.html" }, { "@id": "https://cwe.mitre.org/data/definitions/807.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·4", "skos:prefLabel": { "@value": "Extension Differential", "@language": "en-GB" }, "skos:definition": { "@value": "Hops handle extensions (pipelining, chunking, SMTPUTF8, 8BITMIME) inconsistently, creating exploitable disagreement.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every control handles every advertised extension, or the extension is not advertised.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Apply the same content hooks to BDAT (CHUNKING) as to DATA, and test each scanner against both paths.", "@language": "en-GB" }, { "@value": "Convert or reject messages that use an extension the next hop does not support rather than passing them through unchanged.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, { "@id": "https://cwe.mitre.org/data/definitions/436.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·3", "skos:prefLabel": { "@value": "Address Parsing Differential", "@language": "en-GB" }, "skos:definition": { "@value": "Quoted local parts, comments, aliases and rewriting make an address route differently from how it was validated.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "One parser validates, routes and displays addresses, and rewriting is re-checked.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Use a single address-parsing library across validation, routing and display, with a shared test corpus of quoted local parts, comments and non-ASCII addresses.", "@language": "en-GB" }, { "@value": "Re-apply recipient policy after alias expansion, sub-address stripping and rewriting, using the final mailbox identity.", "@language": "en-GB" }, { "@value": "Reject addresses that use syntax the platform has no business accepting (comments, quoted local parts with control characters, source routes) at the first hop.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, { "@id": "https://cwe.mitre.org/data/definitions/179.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/#sm-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/smtp/" }, "skos:notation": "SM·2", "skos:prefLabel": { "@value": "Backscatter Reflection", "@language": "en-GB" }, "skos:definition": { "@value": "A bounce or auto-reply for a message with a forged envelope sender goes to the victim named in it, so the platform delivers attacker content under its own good reputation.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform never sends mail to an identity it has not verified, and bounces are mail.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject in session so that no bounce is needed; where a later bounce is unavoidable, send it only when the envelope sender passed SPF or DKIM, and omit the original content.", "@language": "en-GB" }, { "@value": "Cap bounces and auto-replies per destination domain and suppress them entirely for mail that failed authentication.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" }, { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/490.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/490.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/441.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/441.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "MI", "skos:prefLabel": { "@value": "MIME and S/MIME", "@language": "en-GB" }, "skos:definition": { "@value": "Every component that handles a message should interpret it the same way, and most content attacks live where they do not. These entries cover how content is parsed, decoded, rendered, signed and encrypted.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "How content is parsed, decoded, rendered, signed and encrypted", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-2" } ], "ost:position": 5, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·A", "skos:prefLabel": { "@value": "Structure Differential", "@language": "en-GB" }, "skos:definition": { "@value": "Malformed boundaries or nesting make the scanner and the client see different body structures.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The structure the scanner inspects is the structure the client renders.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Parse once at ingress into a canonical MIME tree, reject messages that parse ambiguously, and deliver the canonical form.", "@language": "en-GB" }, { "@value": "Run differential tests between the scanner's parser and each supported client's parser on a corpus of malformed messages.", "@language": "en-GB" }, { "@value": "Deliver to the client a message the platform has re-serialised from its canonical tree, so the client never sees the bytes the scanner did not.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, { "@id": "https://cwe.mitre.org/data/definitions/437.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·K", "skos:prefLabel": { "@value": "Encoding Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Encoded-words, charset tricks and transfer-encoding quirks disguise content from inspection.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Content is decoded to a canonical form before inspection, in the same way the client decodes it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Fully decode transfer encodings and encoded-words before every inspection, and treat undecodable content as unscanned.", "@language": "en-GB" }, { "@value": "Normalise charsets to UTF-8 and reject or flag nested, invalid or conflicting encodings.", "@language": "en-GB" }, { "@value": "Decode in a sandboxed worker with limits on size, depth and time, and treat hitting a limit as a verdict in its own right (see Nesting and Decompression Exhaustion).", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/267.html" }, { "@id": "https://capec.mitre.org/data/definitions/120.html" }, { "@id": "https://capec.mitre.org/data/definitions/71.html" }, { "@id": "https://capec.mitre.org/data/definitions/80.html" }, { "@id": "https://cwe.mitre.org/data/definitions/173.html" }, { "@id": "https://cwe.mitre.org/data/definitions/180.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/267.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/173.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·Q", "skos:prefLabel": { "@value": "Content-Type Confusion", "@language": "en-GB" }, "skos:definition": { "@value": "The declared type differs from the actual type, or a file is valid as several types at once.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A file's type is determined by its content, and all components agree on it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Sniff the actual type of every attachment and scan by that type regardless of declaration or extension.", "@language": "en-GB" }, { "@value": "Block or rename attachments whose declared, extension and sniffed types disagree, and render previews only by sniffed type.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/209.html" }, { "@id": "https://capec.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/209.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/430.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/430.html" }, { "@id": "https://cwe.mitre.org/data/definitions/646.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·J", "skos:prefLabel": { "@value": "Active and Remote Content", "@language": "en-GB" }, "skos:definition": { "@value": "HTML and CSS track, exfiltrate or fetch content the platform never inspected.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "No content in a message can cause a fetch or execute code without the recipient's decision.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Sanitise HTML with an allow list that removes scripts, forms, external CSS and conditional comments.", "@language": "en-GB" }, { "@value": "Block remote content by default and, when loaded, fetch it through a proxy that re-scans it and strips tracking parameters.", "@language": "en-GB" }, { "@value": "Render HTML in the client inside an isolated frame with no script, no form submission and a content security policy that permits only proxied images.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/79.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/79.html" }, { "@id": "https://cwe.mitre.org/data/definitions/829.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·10", "skos:prefLabel": { "@value": "Signature Stripping and Wrapping", "@language": "en-GB" }, "skos:definition": { "@value": "A signature is removed, or made to appear to cover content it does not.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The interface shows exactly what a signature covers and nothing more.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Display a signature indicator per signed part, never for the whole message, and mark unsigned parts visibly.", "@language": "en-GB" }, { "@value": "Refuse to render signed and unsigned parts as one continuous body.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/477.html" }, { "@id": "https://cwe.mitre.org/data/definitions/349.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/477.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/349.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·9", "skos:prefLabel": { "@value": "Encryption as Blindfold and Oracle", "@language": "en-GB" }, "skos:definition": { "@value": "Encrypted content blinds the scanner, and malleable ciphertext leaks plaintext through the client.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Content the platform cannot inspect is handled by explicit policy, and clients reject malleable ciphertext.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Hold or flag encrypted mail the platform cannot decrypt, with the choice set per tenant and defaulting to a visible warning.", "@language": "en-GB" }, { "@value": "Require authenticated encryption, refuse to render modified ciphertext, and never load remote content from decrypted parts.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/463.html" }, { "@id": "https://cwe.mitre.org/data/definitions/353.html" }, { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/463.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/353.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·8", "skos:prefLabel": { "@value": "Header Differential", "@language": "en-GB" }, "skos:definition": { "@value": "Duplicate, folded or malformed headers are read differently by different components.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every component reads the same header occurrence, and ambiguity is rejected.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Reject at ingress any message with duplicate single-instance headers (From, Subject, Date, Message-ID).", "@language": "en-GB" }, { "@value": "Normalise header folding and whitespace once at ingress and pass the normalised message to every later component.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/436.html" }, { "@id": "https://cwe.mitre.org/data/definitions/235.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·7", "skos:prefLabel": { "@value": "Attachment Identity Deception", "@language": "en-GB" }, "skos:definition": { "@value": "Filename continuations, right-to-left overrides and double extensions misrepresent what an attachment is.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The attachment name a user sees is the name every component used, and it cannot misrepresent the type.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Strip or visibly render bidirectional control characters and zero-width characters in filenames.", "@language": "en-GB" }, { "@value": "Use one filename resolution across scanner and client when parameters disagree, and show the sniffed type next to the name.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/635.html" }, { "@id": "https://capec.mitre.org/data/definitions/649.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, { "@id": "https://cwe.mitre.org/data/definitions/436.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/635.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·6", "skos:prefLabel": { "@value": "Nesting and Decompression Exhaustion", "@language": "en-GB" }, "skos:definition": { "@value": "Archive bombs and deeply nested messages exhaust the parser or push it past its limits.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Decompression and nesting limits are enforced while expanding, and reaching one is a verdict.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Enforce depth, ratio and total-size limits during expansion, aborting the moment a limit is hit.", "@language": "en-GB" }, { "@value": "Treat a hit limit as UNSCANNED (see Fail-Open Scanning) and expand archives in an isolated, time-bounded process.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/197.html" }, { "@id": "https://capec.mitre.org/data/definitions/230.html" }, { "@id": "https://cwe.mitre.org/data/definitions/409.html" }, { "@id": "https://cwe.mitre.org/data/definitions/674.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/197.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/409.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·5", "skos:prefLabel": { "@value": "Embedded Format Blind Spots", "@language": "en-GB" }, "skos:definition": { "@value": "Attached messages, TNEF, calendar items, partial and external-body parts carry content the scanner does not unpack.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every container format the client opens is a format the scanner unpacks.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Maintain one list of container formats (message/rfc822, TNEF, calendar, archives) shared by the scanners and the client, and test coverage against it.", "@language": "en-GB" }, { "@value": "Refuse message/partial and message/external-body, and inspect calendar fields (location, description, URL) as body content.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/636.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/437.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·4", "skos:prefLabel": { "@value": "Display Divergence", "@language": "en-GB" }, "skos:definition": { "@value": "Text and HTML alternatives differ, or conditional styling changes what is shown in another client or after forwarding.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every alternative and every rendering variant is inspected.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Scan all MIME alternatives, not only the preferred one, and flag messages whose alternatives differ materially.", "@language": "en-GB" }, { "@value": "Strip CSS and markup that hides or reveals content conditionally (display:none, media queries, mso conditionals).", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/148.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/148.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·3", "skos:prefLabel": { "@value": "Parser Memory Safety", "@language": "en-GB" }, "skos:definition": { "@value": "Complex untrusted formats are parsed in privileged processes such as scanners, converters and preview generators.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Untrusted content is parsed in an isolated process with no access to anything else.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Run parsers, converters and preview generators in sandboxed, network-less workers with no credentials and no access to other messages.", "@language": "en-GB" }, { "@value": "Prefer memory-safe parser implementations and automate parser library updates with a short deployment deadline.", "@language": "en-GB" }, { "@value": "Apply resource limits (CPU, memory, time, file descriptors) per parse and treat a limit hit as a verdict, not as a crash to retry.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/100.html" }, { "@id": "https://capec.mitre.org/data/definitions/28.html" }, { "@id": "https://cwe.mitre.org/data/definitions/653.html" }, { "@id": "https://cwe.mitre.org/data/definitions/250.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/100.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/653.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/#mi-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/mime-and-s-mime/" }, "skos:notation": "MI·2", "skos:prefLabel": { "@value": "Certificate and Key Handling", "@language": "en-GB" }, "skos:definition": { "@value": "Certificates are accepted with mismatched addresses or unchecked revocation, or private keys are escrowed where a compromise exposes all mail.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Certificates are validated against the sender shown, revocation is checked, and private keys are compartmentalised.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Match the certificate's email address to the displayed From, check revocation, and treat an unavailable revocation check as failure.", "@language": "en-GB" }, { "@value": "Hold private keys per tenant in an HSM or KMS with per-operation access control, never in a shared store beside the scanner.", "@language": "en-GB" }, { "@value": "Separate signature verification from decryption so that a verification failure is reported even when the message decrypts, and never show a verified mark for a message whose signature covers only part of it.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/475.html" }, { "@id": "https://capec.mitre.org/data/definitions/474.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/475.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/295.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/295.html" }, { "@id": "https://cwe.mitre.org/data/definitions/299.html" }, { "@id": "https://cwe.mitre.org/data/definitions/653.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "DN", "skos:prefLabel": { "@value": "DNS layer", "@language": "en-GB" }, "skos:definition": { "@value": "DNS decides where mail goes and who may send it, so whoever controls or falsifies an answer controls the mail. These entries cover the records the platform publishes, hosts for tenants and resolves.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "The records and resolvers that say where mail goes and who may send it", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-2" } ], "ost:position": 6, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/authentication-protocols/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·A", "skos:prefLabel": { "@value": "MX Redirection", "@language": "en-GB" }, "skos:definition": { "@value": "Cache poisoning, DNS account hijack or route hijack sends mail for a domain to an attacker.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform notices when mail for a domain stops arriving at it, and protects its own records.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Monitor inbound volume per hosted domain and alert on an unexpected drop or an MX that no longer points at the platform.", "@language": "en-GB" }, { "@value": "Protect the platform's registrar and DNS accounts with hardware MFA, change alerts and registry lock.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/142.html" }, { "@id": "https://capec.mitre.org/data/definitions/585.html" }, { "@id": "https://capec.mitre.org/data/definitions/598.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/142.html" }, "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·K", "skos:prefLabel": { "@value": "Dangling Mail Records", "@language": "en-GB" }, "skos:definition": { "@value": "MX, delegated DKIM selectors or SPF includes point at deprovisioned resources someone else can claim.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Deprovisioning removes or neutralises every record that pointed at the resource.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Generate per-tenant, unguessable hostnames and selectors so a departed tenant's records cannot be claimed by a new one.", "@language": "en-GB" }, { "@value": "Run a deprovisioning checklist that revokes keys, retires selectors and reserves the tenant's hostnames for a cooling-off period.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/672.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/672.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·Q", "skos:prefLabel": { "@value": "Unauthenticated Answers", "@language": "en-GB" }, "skos:definition": { "@value": "Without DNSSEC validation, every lookup the platform relies on (MX, SPF, DKIM, DMARC, MTA-STS, block lists) can be answered by whoever reaches the resolver first.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Lookups the platform relies on are authenticated, and validation failure is handled deliberately.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Use DNSSEC-validating resolvers and treat validation failure as a temporary error (defer), not as \"no record\".", "@language": "en-GB" }, { "@value": "Sign the platform's own mail zones so that recipients and senders can validate the records they look up.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/598.html" }, { "@id": "https://capec.mitre.org/data/definitions/142.html" }, { "@id": "https://cwe.mitre.org/data/definitions/353.html" }, { "@id": "https://cwe.mitre.org/data/definitions/346.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/598.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/353.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·J", "skos:prefLabel": { "@value": "Transport Policy Downgrade", "@language": "en-GB" }, "skos:definition": { "@value": "MTA-STS policy or TLSA records are stripped, stale or taken over.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A transport policy that disappears or breaks raises suspicion rather than silently relaxing security.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Keep the MTA-STS policy host under the platform's own certificate automation with expiry alerts well in advance.", "@language": "en-GB" }, { "@value": "Cache sender-side policies and treat a previously seen policy that vanishes as a downgrade attempt to be deferred.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/620.html" }, { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/620.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·10", "skos:prefLabel": { "@value": "Domain Lifecycle Gap", "@language": "en-GB" }, "skos:definition": { "@value": "The platform keeps trusting, or holding mailboxes for, a tenant domain whose ownership has lapsed or changed.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Domain ownership is a continuing condition, re-verified over the life of the tenant.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Re-verify domain ownership on a schedule and on registrar change events, and suspend sending rights when verification fails.", "@language": "en-GB" }, { "@value": "Expire mailboxes, keys and sending rights for a domain whose ownership has lapsed, with a notified grace period.", "@language": "en-GB" }, { "@value": "Monitor registrar WHOIS and NS changes for every verified domain and treat a change of registrant or nameserver as a re-verification event.", "@language": "en-GB" }, { "@value": "Give the tenant admin a page listing every domain, its verification state and the date it was last proven.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, { "@id": "https://cwe.mitre.org/data/definitions/672.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·9", "skos:prefLabel": { "@value": "Weak Ownership Verification", "@language": "en-GB" }, "skos:definition": { "@value": "Tenant onboarding verifies a domain with a weak, replayable or never-rechecked proof.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Ownership proof is unique, single-use and specific to the claim being made.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Issue a random, single-use verification token per tenant per domain, and never derive it from the domain name.", "@language": "en-GB" }, { "@value": "Reject a claim to a domain or overlapping subdomain already verified by another tenant, and separate subdomain rights from parent rights.", "@language": "en-GB" }, { "@value": "Require the proof record to be present and correct at every re-verification, not only at onboarding, and remove the tenant's rights when the record disappears.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/283.html" }, { "@id": "https://cwe.mitre.org/data/definitions/340.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·8", "skos:prefLabel": { "@value": "Resolver Trust", "@language": "en-GB" }, "skos:definition": { "@value": "The platform's resolvers are poisonable, shared across tenants, or treat attacker-controlled answers as safe input.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Resolvers are dedicated, validating and bound what they accept from the network.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Run dedicated, DNSSEC-validating resolvers on private addresses with source-port and transaction-ID randomisation.", "@language": "en-GB" }, { "@value": "Bound answer size, record count and TTL before passing any answer to an authentication or routing component.", "@language": "en-GB" }, { "@value": "Rate-limit queries per sending domain and per message so that one sender cannot use the resolver to amplify work against third parties (see Lookup Amplification).", "@language": "en-GB" }, { "@value": "Keep an independent second resolver path for critical lookups and compare answers when they disagree.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/142.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/142.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/331.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/331.html" }, { "@id": "https://cwe.mitre.org/data/definitions/653.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·7", "skos:prefLabel": { "@value": "Lookup Amplification", "@language": "en-GB" }, "skos:definition": { "@value": "Authentication checks trigger sender-directed DNS queries that exhaust the resolver or reflect onto a victim.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Sender-controlled records cannot make the platform do unbounded work.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Enforce the SPF limit of ten DNS-querying mechanisms and void lookups, and treat exceeding it as permerror.", "@language": "en-GB" }, { "@value": "Cap total DNS queries per inbound message and per sender domain per minute, and cache negative results.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/490.html" }, { "@id": "https://cwe.mitre.org/data/definitions/405.html" }, { "@id": "https://cwe.mitre.org/data/definitions/406.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/490.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/405.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·6", "skos:prefLabel": { "@value": "DNS Failure Semantics", "@language": "en-GB" }, "skos:definition": { "@value": "Lookup failures are treated as \"no policy\", and fallbacks such as implicit MX are followed unsafely.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Each DNS failure mode has a defined, deliberate meaning.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Distinguish timeout, SERVFAIL and NXDOMAIN in every lookup, and map temporary failures to defer rather than \"no policy\".", "@language": "en-GB" }, { "@value": "Honour null MX and never fall back to an A or AAAA record for a domain that publishes one.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" }, { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/589.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/589.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, { "@id": "https://cwe.mitre.org/data/definitions/754.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·5", "skos:prefLabel": { "@value": "Reputation Feed Dependency", "@language": "en-GB" }, "skos:definition": { "@value": "DNS-based blocklists are an integrity and availability dependency that can fail, lapse or be poisoned.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "No single external feed can stop or open the mail flow on its own.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Require agreement between at least two reputation sources for a reject, and treat a list answering \"listed\" for a known-good test address as broken.", "@language": "en-GB" }, { "@value": "Monitor each list's responsiveness and domain registration, and fail to neutral when a list is unreachable.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/589.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/589.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/654.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/654.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1357.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·4", "skos:prefLabel": { "@value": "Cached Policy Poisoning", "@language": "en-GB" }, "skos:definition": { "@value": "A bad policy or record, once cached, outlives the attack that planted it.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Cached policy cannot outlive the trust it was based on.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Cap the lifetime honoured for cached policies and records regardless of the published TTL.", "@language": "en-GB" }, { "@value": "Provide an operator control to flush cached entries for one domain, and alert on sudden changes to long-lived policies.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/141.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/141.html" }, "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·3", "skos:prefLabel": { "@value": "Signing Failure Outage", "@language": "en-GB" }, "skos:definition": { "@value": "The platform's own signed zones or validating resolvers go dark: an expired signature, a failed key rollover or a validation bug makes every record the platform publishes or depends on unresolvable, and all mail stops.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform's own DNS cannot silently expire, and its failure is detected before the mail stops.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Automate key rollover and signature refresh, and monitor signature expiry and validation from an external validating resolver.", "@language": "en-GB" }, { "@value": "Rehearse rollover and recovery in a staging zone, and keep an emergency procedure to republish or unsign the zone.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/#dn-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/dns-layer/" }, "skos:notation": "DN·2", "skos:prefLabel": { "@value": "Internationalised Domain Confusion", "@language": "en-GB" }, "skos:definition": { "@value": "Punycode, homoglyph and malformed domains (NUL, invisible characters, a trailing period) are compared, resolved or displayed inconsistently across components.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Domains are normalised to one canonical form before any component compares, resolves or displays them.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Normalise every domain to its A-label form at ingress, rejecting labels with control characters, NUL or invisible code points, and apply the same normalisation to allow lists, block lists, DNS lookups and authentication.", "@language": "en-GB" }, { "@value": "Flag mixed-script labels and labels confusable with a known contact's domain, and display them in a visibly distinct form.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/632.html" }, { "@id": "https://capec.mitre.org/data/definitions/52.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1289.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1007.html" }, { "@id": "https://cwe.mitre.org/data/definitions/158.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/632.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1289.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "CS", "skos:prefLabel": { "@value": "Content scanners", "@language": "en-GB" }, "skos:definition": { "@value": "A scanner is a probabilistic control that an attacker can study, evade and attack directly. These entries cover URL analysis, malware detection, sandboxes, machine learning (ML) and large language model (LLM) classifiers, and data loss prevention (DLP).", "@language": "en-GB" }, "skos:scopeNote": { "@value": "URL, malware, sandbox, ML and LLM inspection engines", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-2" } ], "ost:position": 7, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:related": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/delivery-pipeline/" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·A", "skos:prefLabel": { "@value": "Analysis-Aware Content", "@language": "en-GB" }, "skos:definition": { "@value": "Content or a URL detects the scanner (IP range, user agent, sandbox artefacts, timing) and behaves benignly for it.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The scanner's view of content is indistinguishable from a user's.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Fetch URLs from residential-like, rotating egress with realistic browser fingerprints, and detonate samples in sandboxes that resemble real endpoints.", "@language": "en-GB" }, { "@value": "Treat \"nothing happened\" as inconclusive rather than clean, and combine it with destination reputation before deciding.", "@language": "en-GB" }, { "@value": "Rotate and measure the detonation environment's fingerprints against real user traffic, and rebuild it when attackers begin to distinguish it.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/224.html" }, { "@id": "https://cwe.mitre.org/data/definitions/205.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/224.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/205.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·K", "skos:prefLabel": { "@value": "Scanner Prompt Injection", "@language": "en-GB" }, "skos:definition": { "@value": "Message content is interpreted as instructions by an LLM-based classifier, summariser or assistant.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Message content is data to a model, never instructions, and no security decision depends on the model resisting it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Pass message content to the classifier as a delimited, typed input with no tool access and a fixed output schema.", "@language": "en-GB" }, { "@value": "Back every model verdict with deterministic rules so that a manipulated model score cannot release a message on its own.", "@language": "en-GB" }, { "@value": "Audit the model's behaviour on a corpus of injection attempts as part of every model or prompt change, with a release gate on the detection rate.", "@language": "en-GB" }, { "@value": "Log model inputs and outputs for sampled traffic so that a manipulation campaign can be reconstructed afterwards.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1427.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/1427.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·Q", "skos:prefLabel": { "@value": "Gated Content", "@language": "en-GB" }, "skos:definition": { "@value": "The payload sits behind a CAPTCHA, login, password or QR code that the scanner cannot pass.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Content the scanner cannot reach gets its own verdict and gating counts against the message.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Return UNREACHABLE for gated content and apply a hold-or-flag policy to it rather than \"clean\".", "@language": "en-GB" }, { "@value": "Try passwords found in the message body or subject against protected archives, and score CAPTCHA and login gates as risk signals.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/636.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·J", "skos:prefLabel": { "@value": "Reputation Laundering", "@language": "en-GB" }, "skos:definition": { "@value": "A URL routes through trusted domains, open redirects or the platform's own rewritten links, so only the first hop is judged.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A URL is judged by where it ends up, not where it starts.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Follow the complete redirect chain, including the platform's own rewrites, and judge the final destination.", "@language": "en-GB" }, { "@value": "Bind rewritten links to the recipient and message so a link cannot be lifted and reused elsewhere.", "@language": "en-GB" }, { "@value": "Re-evaluate the destination at the moment of click, and block or warn when it differs from what was judged at delivery (see Check Once, Use Later).", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/601.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/601.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·10", "skos:prefLabel": { "@value": "Classifier Evasion", "@language": "en-GB" }, "skos:definition": { "@value": "Adversarial perturbation (padding, homoglyphs, text in images) moves content across an ML detector's decision boundary.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "No decision rests on a single statistical score.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Normalise input (strip hidden text, decode homoglyphs, OCR images) before classification.", "@language": "en-GB" }, { "@value": "Pair each ML classifier with a deterministic control (signature, policy, reputation) that can block regardless of score.", "@language": "en-GB" }, { "@value": "Watch the score distribution per tenant and per feature for shifts that indicate adversarial probing, and raise the threshold for sources that are probing.", "@language": "en-GB" }, { "@value": "Keep the model's features and thresholds out of anything the sender can observe (see Verdict Oracle).", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1039.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/1039.html" }, { "@id": "https://cwe.mitre.org/data/definitions/654.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·9", "skos:prefLabel": { "@value": "Classifier Poisoning", "@language": "en-GB" }, "skos:definition": { "@value": "Feedback loops such as user reports and quarantine releases let an attacker shape what the model learns.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Training signal is weighted by who provides it and watched for drift.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Weight feedback by account age, tenant reputation and corroboration, and exclude trial and new accounts from training.", "@language": "en-GB" }, { "@value": "Monitor label distributions per tenant and per source, and hold back model updates when a shift exceeds a threshold.", "@language": "en-GB" }, { "@value": "Review the training set for a sample of each update against ground truth, and keep a rollback to the last trusted model.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Clean", "ost:capecMatch": "None", "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·8", "skos:prefLabel": { "@value": "Scanner as Attack Surface", "@language": "en-GB" }, "skos:definition": { "@value": "Parsing, detonating or fetching untrusted content leads to code execution, sandbox escape or server-side request forgery inside the platform.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A compromised scanner can reach nothing but the sample in front of it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Run detonation and URL fetching in ephemeral, network-isolated environments with no route to internal services and no credentials.", "@language": "en-GB" }, { "@value": "Destroy the environment after each sample and treat any outbound connection attempt as a finding.", "@language": "en-GB" }, { "@value": "Hold the scanner's own credentials (feed subscriptions, API keys) in a broker outside the detonation environment, so that a compromised sample cannot read them.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/664.html" }, { "@id": "https://capec.mitre.org/data/definitions/100.html" }, { "@id": "https://capec.mitre.org/data/definitions/237.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/664.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/653.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/653.html" }, { "@id": "https://cwe.mitre.org/data/definitions/918.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·7", "skos:prefLabel": { "@value": "Scanner Side Effects", "@language": "en-GB" }, "skos:definition": { "@value": "Fetching URLs consumes one-time links, triggers actions on the recipient's behalf, or confirms the address to the sender.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The scanner observes without acting on the recipient's behalf.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Fetch with HEAD or a safe GET that follows no one-time or state-changing links, and skip links matching unsubscribe, confirm or approve patterns.", "@language": "en-GB" }, { "@value": "Fetch from egress that does not identify the product or tenant, and delay fetches randomly so timing does not confirm delivery.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/441.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/441.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·6", "skos:prefLabel": { "@value": "Verdict Oracle", "@language": "en-GB" }, "skos:definition": { "@value": "An attacker can test content against the scanner and iterate until it passes, or read its verdicts, scores and rule names in the headers delivered with the message.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "An attacker cannot learn what the scanner decided or why, whether by probing it or by reading what it wrote.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Strip verdict, score, rule-name and diagnostic headers before delivery and keep them in the platform's own logs, so they never travel with delivered, forwarded or replied mail.", "@language": "en-GB" }, { "@value": "Detect repeated near-identical submissions from one source, including trial and free-tier accounts, and degrade the signal they receive.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/54.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/54.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/201.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/201.html" }, { "@id": "https://cwe.mitre.org/data/definitions/203.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·5", "skos:prefLabel": { "@value": "Novelty Window", "@language": "en-GB" }, "skos:definition": { "@value": "Detection relies on known-bad indicators, so new domains and new payloads pass until the lists catch up.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "What is new is treated as unknown, and unknown has a policy.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Apply extra scrutiny to domains registered within a configurable window and to never-seen file types or senders.", "@language": "en-GB" }, { "@value": "Re-judge delivered mail when intelligence arrives (see Remediation Race) so the novelty window closes retroactively.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/184.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/184.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·4", "skos:prefLabel": { "@value": "Modality Gap", "@language": "en-GB" }, "skos:definition": { "@value": "The payload is in a form the scanner does not analyse: image text, audio, QR codes, links inside documents.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every modality a user can act on is a modality the scanner inspects.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Extract and analyse links and text from images, QR codes, PDFs, documents and calendar items.", "@language": "en-GB" }, { "@value": "Add scanning coverage to the definition of done for every new client feature that displays content.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/636.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/437.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/437.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·3", "skos:prefLabel": { "@value": "Scanned Data Exposure", "@language": "en-GB" }, "skos:definition": { "@value": "Mail sent to third-party engines, cloud sandboxes or model APIs leaks, or cached verdicts and samples cross tenants.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Content leaves the platform only under contract, and verdicts never cross tenants.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Restrict third-party engines to hash lookups by default and require tenant opt-in for sample submission, with retention terms in the contract.", "@language": "en-GB" }, { "@value": "Namespace verdict caches and samples per tenant so a cache hit reveals nothing about another tenant's mail.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/204.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/204.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/524.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/524.html" }, { "@id": "https://cwe.mitre.org/data/definitions/201.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/#cs-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/content-scanners/" }, "skos:notation": "CS·2", "skos:prefLabel": { "@value": "Exemption Abuse", "@language": "en-GB" }, "skos:definition": { "@value": "Allow lists, trusted-sender rules and skip conditions exempt content from scanning altogether.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Exemptions are scoped, verified, time-limited and reviewed.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Bind exemptions to a verified property (DKIM-aligned domain, authenticated connector), never to a header or address the sender controls.", "@language": "en-GB" }, { "@value": "Expire exemptions by default and show tenant admins a periodic review of active exemptions.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/554.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/554.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/183.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/183.html" }, { "@id": "https://cwe.mitre.org/data/definitions/807.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "HF", "skos:prefLabel": { "@value": "Human-facing layer", "@language": "en-GB" }, "skos:definition": { "@value": "The interface decides which facts about a message a person sees before they act on it. These entries cover what the client and the platform present, and the decisions the design leaves to the user.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "What the client and platform present to the person reading or sending", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-2" } ], "ost:position": 8, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·A", "skos:prefLabel": { "@value": "Display Name Deception", "@language": "en-GB" }, "skos:definition": { "@value": "The interface shows the display name prominently and hides or truncates the address.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The address is as visible as the name, in every view.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Show the full sender address next to the display name in message lists, readers and notifications without extra taps.", "@language": "en-GB" }, { "@value": "Mark first-time senders and display names that look like addresses or match a known contact's name.", "@language": "en-GB" }, { "@value": "Keep the display name and address visually distinct (type, weight) so that an address-like display name cannot masquerade as the address.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/148.html" }, { "@id": "https://capec.mitre.org/data/definitions/98.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/148.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·K", "skos:prefLabel": { "@value": "Lookalike Rendering", "@language": "en-GB" }, "skos:definition": { "@value": "Homoglyph, internationalised and long-subdomain addresses are displayed without distinction from the genuine one.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Confusable domains are displayed so that they do not look like the genuine one.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Render punycode and mixed-script domains in a distinct visual form and emphasise the registrable domain.", "@language": "en-GB" }, { "@value": "Compare the sender domain to the user's contacts and the tenant's domains, and flag close matches.", "@language": "en-GB" }, { "@value": "Apply the same rendering in notifications, previews and the compose window, not only in the reader.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/632.html" }, { "@id": "https://capec.mitre.org/data/definitions/630.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1007.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/632.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1007.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·Q", "skos:prefLabel": { "@value": "Thread Hijack", "@language": "en-GB" }, "skos:definition": { "@value": "An attacker's message is grouped into a trusted conversation and inherits its credibility.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A thread groups only messages that provably belong together.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Thread on Message-ID, In-Reply-To and References, never on subject alone.", "@language": "en-GB" }, { "@value": "Show a visible break and a warning when a new sender or domain joins an existing thread.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/98.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1023.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/98.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·J", "skos:prefLabel": { "@value": "Indicator Spoofing", "@language": "en-GB" }, "skos:definition": { "@value": "Banners, verified marks and \"scanned\" labels are imitated in the message body or suppressed by styling.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Security indicators live where message content cannot draw.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Render banners, verified marks and warnings in client chrome outside the message body area.", "@language": "en-GB" }, { "@value": "Sanitise message styling so it cannot overlay, hide or imitate chrome elements, and never insert indicators into the body.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/222.html" }, { "@id": "https://capec.mitre.org/data/definitions/173.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/222.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1021.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·10", "skos:prefLabel": { "@value": "Reply-Path Diversion", "@language": "en-GB" }, "skos:definition": { "@value": "Replies go to an address different from the visible sender, and the interface does not surface it.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The user sees where a reply will go before sending it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Show the Reply-To address in the compose view when it differs from From, with a warning if the domain differs.", "@language": "en-GB" }, { "@value": "Treat a cross-domain Reply-To as a risk signal in scoring and in the reader's sender display.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/148.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/148.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·9", "skos:prefLabel": { "@value": "Link Presentation Mismatch", "@language": "en-GB" }, "skos:definition": { "@value": "The displayed link differs from its target, or rewriting hides the real destination from the user.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The user can see a link's true destination before following it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Display the final destination domain on hover and long-press, including for rewritten links.", "@language": "en-GB" }, { "@value": "Flag link text that looks like a URL but points elsewhere.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/173.html" }, { "@id": "https://capec.mitre.org/data/definitions/148.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/173.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·8", "skos:prefLabel": { "@value": "Warning Fatigue", "@language": "en-GB" }, "skos:definition": { "@value": "Warnings appear so often, or so indiscriminately, that users stop reading them.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Warnings are specific, rare and measured.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Replace the generic external banner with targeted warnings that say what is unusual and what to do.", "@language": "en-GB" }, { "@value": "Measure click-through after each warning type and retire the ones that do not change behaviour.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/416.html" }, { "@id": "https://cwe.mitre.org/data/definitions/357.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/416.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/357.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·7", "skos:prefLabel": { "@value": "Trusted Internal Sender", "@language": "en-GB" }, "skos:definition": { "@value": "Mail from a compromised internal account carries no warning and receives more trust than external mail.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Internal mail earns no trust it has not been checked for.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Apply the same content scanning to internal and intra-platform mail as to external mail.", "@language": "en-GB" }, { "@value": "Surface behavioural anomalies for internal senders (new device, unusual volume, first-time recipients) in the recipient's view.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/163.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/163.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/424.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·6", "skos:prefLabel": { "@value": "Platform Feature Mimicry", "@language": "en-GB" }, "skos:definition": { "@value": "Sharing invitations, calendar invites, quarantine digests and similar features deliver lures from genuine platform addresses.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Platform notifications carry no user-chosen content that could be a lure.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Scan sharing invitations, calendar invites and digests like any other mail, including user-supplied fields.", "@language": "en-GB" }, { "@value": "Render user-supplied text in notifications visibly separated from the platform's own text.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/148.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/148.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·5", "skos:prefLabel": { "@value": "Auto-Added Content", "@language": "en-GB" }, "skos:definition": { "@value": "Invites, contacts and autocomplete entries are created from unsolicited mail without the user's action.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Nothing is added to the user's calendar, contacts or autocomplete without their action.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Hold calendar invites from unknown senders as pending rather than adding tentative events.", "@language": "en-GB" }, { "@value": "Populate autocomplete only from addresses the user has sent to, not from inbound mail.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/356.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/356.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·4", "skos:prefLabel": { "@value": "Assistant-Mediated Deception", "@language": "en-GB" }, "skos:definition": { "@value": "AI summaries and suggested replies relay attacker content in the platform's own voice.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "An assistant presents message content as the message's claim, never as the platform's.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Attribute every summarised statement to the message and exclude links and instructions from summaries.", "@language": "en-GB" }, { "@value": "Isolate message content from the assistant's instructions (see Scanner Prompt Injection) and give the assistant no actions beyond summarising.", "@language": "en-GB" }, { "@value": "Show the user the exact passage the assistant drew on for each claim, so that hidden or off-screen text is exposed when it is summarised.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1427.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·3", "skos:prefLabel": { "@value": "Signal Loss in Compact Views", "@language": "en-GB" }, "skos:definition": { "@value": "Mobile and condensed views drop the indicators the desktop design relies on.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every surface a user can act from shows the signals the decision needs.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Define a minimum indicator set (sender address, external marker, warning) required on every surface, including notifications and quick replies.", "@language": "en-GB" }, { "@value": "Disable actions such as quick reply from surfaces that cannot show the minimum set.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/451.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/#hf-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/human-facing-layer/" }, "skos:notation": "HF·2", "skos:prefLabel": { "@value": "Misdirected Send", "@language": "en-GB" }, "skos:definition": { "@value": "Autocomplete, reply-all and group expansion lead the user to send to unintended recipients.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The user sees who will receive a message before it leaves.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Warn on external, first-time and recently added recipients before sending.", "@language": "en-GB" }, { "@value": "Expand group recipients to a visible count and membership, and offer a short undo window after send.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/356.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/356.html" }, { "@id": "https://cwe.mitre.org/data/definitions/451.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "OP", "skos:prefLabel": { "@value": "Operations and storage", "@language": "en-GB" }, "skos:definition": { "@value": "The operational plane holds more copies of every message than the mailbox store does, each under a weaker access model. These entries cover archive, backup, search and logs, support and export tooling, configuration, credentials and offboarding.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "The operational plane: archive, backup, search, logs, support access, configuration, offboarding", "@language": "en-GB" }, "ost:unit": "layer", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-a" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-k" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-q" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-j" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-10" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-9" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-2" } ], "ost:position": 9, "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-a", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·A", "skos:prefLabel": { "@value": "Support Access", "@language": "en-GB" }, "skos:definition": { "@value": "Platform staff can open, search or export any tenant's mailbox for troubleshooting, with no ticket, no tenant consent, no time limit and no record the tenant can see.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Support access to tenant data is consented, scoped, time-limited and visible to the tenant.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Require a ticket and the tenant's approval (or a documented emergency path with after-the-fact notice) before a support engineer can open a mailbox, and expire the access automatically.", "@language": "en-GB" }, { "@value": "Log every support access to an append-only store outside the admin console, and show tenants an access report they can audit.", "@language": "en-GB" }, { "@value": "Give support tooling the minimum view needed (headers, routing, logs) and make reading message bodies a separate, rarer privilege.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/122.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1220.html" }, { "@id": "https://cwe.mitre.org/data/definitions/778.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/122.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1220.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-k", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·K", "skos:prefLabel": { "@value": "Bulk Export", "@language": "en-GB" }, "skos:definition": { "@value": "Compliance search, eDiscovery and mailbox export move whole mailboxes or tenants out of the platform in one action, under weaker controls than the mailbox itself.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Bulk export is a privileged, approved, rate-limited and visible operation.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Require a second approver or a step-up factor for any export of a whole mailbox or tenant, and notify the mailbox owner and tenant admin when it happens.", "@language": "en-GB" }, { "@value": "Deliver exports only to an authenticated, short-lived location, scanned and watermarked, and log who downloaded them.", "@language": "en-GB" }, { "@value": "Cap export volume per actor and per day, and alert on exports that do not match the actor's history.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/122.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" }, { "@id": "https://cwe.mitre.org/data/definitions/799.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/122.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/424.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-q", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·Q", "skos:prefLabel": { "@value": "Archive as Second Mailbox", "@language": "en-GB" }, "skos:definition": { "@value": "A journal or archive holds a copy of every message, indefinitely, under its own access model, outside remediation, retention and the mailbox's permissions.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every copy of a message is under the same access, remediation and retention model as the mailbox.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Enforce mailbox-level permissions on archive search, so that no one can read in the archive what they cannot read in the mailbox.", "@language": "en-GB" }, { "@value": "Make remediation, deletion and legal hold propagate to the archive in the same transaction, and reconcile the two stores on a schedule.", "@language": "en-GB" }, { "@value": "Put the archive on the platform's threat model and data-flow diagram as a store in its own right.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/150.html" }, { "@id": "https://cwe.mitre.org/data/definitions/424.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1250.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/150.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/424.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-j", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·J", "skos:prefLabel": { "@value": "Backup Exposure", "@language": "en-GB" }, "skos:definition": { "@value": "Backups and snapshots hold mail, keys and credentials under a different key, a different access model and a different lifetime, and a restore reintroduces what remediation removed.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Backups are encrypted, restore is privileged, and a restore re-applies every control the live store enforces.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Encrypt backups with keys held outside the backup service, require two people to restore, and log every restore.", "@language": "en-GB" }, { "@value": "Run remediation, retention and legal hold against restored data before it becomes visible, and restore into a quarantined store by default.", "@language": "en-GB" }, { "@value": "Apply the live store's access model and lifetime to snapshots, and delete them on schedule.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/150.html" }, { "@id": "https://cwe.mitre.org/data/definitions/530.html" }, { "@id": "https://cwe.mitre.org/data/definitions/1250.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/150.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/530.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-10", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·10", "skos:prefLabel": { "@value": "Unreviewed Configuration Change", "@language": "en-GB" }, "skos:definition": { "@value": "Platform-wide security configuration (policies, scanner thresholds, allow lists, connectors, TLS settings) is edited live, with no review, no diff and no record of the intended state.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Security configuration is declared, reviewed, versioned and reconciled.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Keep the intended configuration as versioned code with a required reviewer, and apply it through a pipeline rather than by hand in a console.", "@language": "en-GB" }, { "@value": "Reconcile the live configuration against the declared state continuously and alert on drift, including changes made through break-glass paths.", "@language": "en-GB" }, { "@value": "Rehearse rollback of every security control's configuration and keep the last known-good state available.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Repudiation" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/176.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/176.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/778.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/778.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-9", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·9", "skos:prefLabel": { "@value": "Connector Credentials", "@language": "en-GB" }, "skos:definition": { "@value": "Credentials for connectors, partner APIs, cloud storage and internal services sit in configuration, are shared across tenants or services, and are never rotated or scoped.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Each credential is scoped to one purpose and one tenant, held in a secrets store, and rotated.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Store connector and partner credentials in a secrets manager with per-service access, never in configuration files or environment variables shared across services.", "@language": "en-GB" }, { "@value": "Issue one credential per tenant and per integration, scoped to the narrowest API permission, and rotate on a schedule and on staff departure.", "@language": "en-GB" }, { "@value": "Monitor the use of each credential and revoke on anomalous use.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/555.html" }, { "@id": "https://capec.mitre.org/data/definitions/560.html" }, { "@id": "https://cwe.mitre.org/data/definitions/260.html" }, { "@id": "https://cwe.mitre.org/data/definitions/522.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/555.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/260.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·8", "skos:prefLabel": { "@value": "Retention and Deletion Gap", "@language": "en-GB" }, "skos:definition": { "@value": "Deletion, retention and legal hold are applied to the mailbox and not to its copies (cache, index, archive, backup, quarantine), so mail persists where it should not or vanishes where it must be kept.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Deletion, retention and hold are enforced across every copy, and the platform can prove it.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Maintain an inventory of every store that holds message copies, and drive deletion, retention and hold from one service that reaches all of them.", "@language": "en-GB" }, { "@value": "Treat a copy that cannot be reached by hold or deletion as a defect, and reconcile stores against the inventory on a schedule.", "@language": "en-GB" }, { "@value": "Produce a deletion certificate per request that lists each store and the time the copy was removed.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Repudiation" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1250.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/1250.html" }, { "@id": "https://cwe.mitre.org/data/definitions/459.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·7", "skos:prefLabel": { "@value": "Content in Logs", "@language": "en-GB" }, "skos:definition": { "@value": "Message content, addresses, subjects, URLs, tokens and headers end up in logs, traces, crash dumps, metrics labels and support tickets, often shipped to a third party.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Logs carry identifiers, never content, and leave the platform only under contract.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Define an allow list of loggable fields (message ID, tenant, sizes, verdicts, timings) and strip or hash everything else at the logging library, not in each service.", "@language": "en-GB" }, { "@value": "Keep logs that must carry content (forensics) in a separate store with its own access control and retention, inside the platform.", "@language": "en-GB" }, { "@value": "Test with messages whose content is a canary string and alert when it appears in any log, trace or ticket.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/37.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/37.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/532.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/532.html" }, { "@id": "https://cwe.mitre.org/data/definitions/528.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·6", "skos:prefLabel": { "@value": "Search Index Leakage", "@language": "en-GB" }, "skos:definition": { "@value": "Search and indexing services hold message content with their own access model, so a query can return what the mailbox permissions would refuse, or another tenant's mail.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The index enforces the same tenancy and permissions as the mailbox store, at query time.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Partition the index per tenant with the tenant identity enforced in the index service from the authenticated session, not from a caller-supplied field.", "@language": "en-GB" }, { "@value": "Apply mailbox permissions at query time by joining against the authorisation source, rather than by rebuilding the index on a schedule.", "@language": "en-GB" }, { "@value": "Treat suggestions, autocomplete and result counts as content and subject them to the same checks.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/1.html" }, { "@id": "https://capec.mitre.org/data/definitions/180.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/1.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/1230.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/1230.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·5", "skos:prefLabel": { "@value": "Audit Gap", "@language": "en-GB" }, "skos:definition": { "@value": "Security-relevant actions (quarantine release, rule and allow-list changes, support access, exports, key operations) are unlogged, logged mutably, or logged without the person who acted.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every security-relevant action is logged, immutably, and attributed to a person.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Enumerate security-relevant actions from the threat model and fail the release of any feature that performs one without logging it.", "@language": "en-GB" }, { "@value": "Write audit records to an append-only store that platform operators cannot alter, with retention set by policy.", "@language": "en-GB" }, { "@value": "Require individual authentication for privileged actions, so no audit record points at a shared role or a service account.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Repudiation" } ], "ost:strideFit": "Clean", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/268.html" }, { "@id": "https://capec.mitre.org/data/definitions/571.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/268.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/778.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/778.html" }, { "@id": "https://cwe.mitre.org/data/definitions/223.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·4", "skos:prefLabel": { "@value": "Offboarding Residue", "@language": "en-GB" }, "skos:definition": { "@value": "When a tenant, user or integration leaves, its data, domains, keys, connectors, tokens and archive copies linger, and whoever acquires its name inherits them.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Offboarding is a defined procedure that removes or neutralises everything the departed party was given.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Keep an inventory of what each tenant, user and integration owns (data, domains, keys, connectors, tokens, grants) and drive offboarding from it, with a verifiable end state.", "@language": "en-GB" }, { "@value": "Hold departed tenants' domains and names in a cooling-off state that no new tenant can claim, and revoke every token, session and delegation at user departure.", "@language": "en-GB" }, { "@value": "Delete or quarantine residual data on a schedule and report what remains.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" }, { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/226.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/226.html" }, { "@id": "https://cwe.mitre.org/data/definitions/672.html" }, { "@id": "https://cwe.mitre.org/data/definitions/459.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·3", "skos:prefLabel": { "@value": "Alert Flood", "@language": "en-GB" }, "skos:definition": { "@value": "Monitoring raises one alert per event, so attacker-generated volume buries the alert that matters, and the on-call learns to ignore the channel.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Alerts are rate-limited, grouped by cause, and the ones about people and privilege have their own channel.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Aggregate message-level alerts by campaign and source, and cap the rate at which any one cause can raise alerts.", "@language": "en-GB" }, { "@value": "Route alerts about privileged actions (support access, exports, configuration changes, key operations) to a separate, low-volume channel with a named owner.", "@language": "en-GB" }, { "@value": "Measure alert volume and response, and remove any alert that has not led to action in a defined period.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Repudiation" }, { "@id": "https://ostering.com/ns/stride#Denialofservice" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/125.html" }, { "@id": "https://cwe.mitre.org/data/definitions/779.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/125.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/779.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/#op-2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/operations-and-storage/" }, "skos:notation": "OP·2", "skos:prefLabel": { "@value": "Production Data Elsewhere", "@language": "en-GB" }, "skos:definition": { "@value": "Copies of production mail are used in staging, test, analytics and model training, under weaker credentials, broader access and no retention.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Real mail exists only in production, and anything derived from it is minimised and controlled.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Generate synthetic mail for staging and test, and forbid restores of production data into any other environment.", "@language": "en-GB" }, { "@value": "Where analytics or model training needs real content, minimise it at source, process it inside production's controls, and delete it on schedule.", "@language": "en-GB" }, { "@value": "Treat every non-production environment that holds tenant data as production for access control and monitoring.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/212.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/212.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:notation": "T", "skos:prefLabel": { "@value": "Structural hazards", "@language": "en-GB" }, "skos:definition": { "@value": "These eight hazards are properties of email itself, so no single component can fix them. Apply them to the whole design after the layers.", "@language": "en-GB" }, "skos:scopeNote": { "@value": "Hazards of email itself", "@language": "en-GB" }, "ost:unit": "structural hazards", "skos:narrower": [ { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t8" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t7" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t6" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t5" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t4" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t3" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t2" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t1" } ], "skos:topConceptOf": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t8", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T8", "skos:prefLabel": { "@value": "Envelope and Header Duality", "@language": "en-GB" }, "skos:definition": { "@value": "The identity used for routing and the identity shown to the user are independent, and every control must choose which one it checks.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "One sender identity is resolved at ingress, and it is the identity every control checks and every user sees.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Resolve a single canonical sender identity at the edge, reject messages where envelope and header identities are ambiguous, and carry the resolved identity in metadata.", "@language": "en-GB" }, { "@value": "Display only the resolved identity in clients, and make every control document which identity it evaluates.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/348.html" }, "skos:closeMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/348.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t7", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T7", "skos:prefLabel": { "@value": "Hop-by-Hop Trust", "@language": "en-GB" }, "skos:definition": { "@value": "There is no end-to-end guarantee; each hop trusts the last, so the path is as strong as its weakest hop.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform verifies for itself what it needs to trust, independent of what earlier hops claim.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Strip inbound trust assertions at every ingress and re-derive them from what the platform can verify.", "@language": "en-GB" }, { "@value": "Identify the hop whose compromise would be believed by all the others, and remove that single point of trust.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/21.html" }, { "@id": "https://cwe.mitre.org/data/definitions/807.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/21.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/807.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t6", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T6", "skos:prefLabel": { "@value": "Legitimate Mutation", "@language": "en-GB" }, "skos:definition": { "@value": "Forwarders, lists, gateways and the platform itself rewrite messages in transit for legitimate reasons, so no integrity control can tell an authorised change from an attack.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The platform verifies what arrives, not what was sent, and knows which of its own components change messages.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Inventory every component that rewrites messages and the authentication results each one breaks, and have each sign what it changed (ARC seal or DKIM) so the change is attributable.", "@language": "en-GB" }, { "@value": "Design integrity checks on what the platform itself observed at ingress rather than assuming the original sender's signature survives to the mailbox.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "None" }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t5", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T5", "skos:prefLabel": { "@value": "Interpretation Differential", "@language": "en-GB" }, "skos:definition": { "@value": "Any two components reading the same bytes may disagree, and attacks live in the disagreement.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "A message is interpreted once, canonically, and ambiguity is rejected rather than guessed.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Canonicalise at ingress and pass the canonical form to every scanner and client.", "@language": "en-GB" }, { "@value": "Reject ambiguous input at the edge and maintain a differential test corpus across every parser in the path.", "@language": "en-GB" }, { "@value": "Treat parser disagreement as a release blocker: any message on which two components in the path differ is rejected until the parsers agree.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/43.html" }, { "@id": "https://cwe.mitre.org/data/definitions/436.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/43.html" }, "ost:cweMatch": "Direct", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/436.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t4", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T4", "skos:prefLabel": { "@value": "Authentication Is Not Trust", "@language": "en-GB" }, "skos:definition": { "@value": "The protocols prove which domain sent a message, never that the domain is benign.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Identity and trust are separate inputs, and an authentication pass never relaxes another control.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Keep authentication results out of scoring, bypass and badge decisions, using them only for DMARC disposition and domain-level reputation.", "@language": "en-GB" }, { "@value": "Make reputation and intent explicit controls with their own evidence, separate from authentication.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Spoofing" } ], "ost:strideFit": "Loose", "ost:capecMatch": "None", "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/654.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/654.html" } ] }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t3", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T3", "skos:prefLabel": { "@value": "Legacy Fail-Open", "@language": "en-GB" }, "skos:definition": { "@value": "Interoperability with every legacy sender means an absent security feature is treated as acceptable.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "Every opportunistic protection has a path and a date to become mandatory.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Publish and enforce policies (MTA-STS, DMARC reject, implicit TLS) for the platform's own domains and defaults.", "@language": "en-GB" }, { "@value": "Track each opportunistic protection with a tightening schedule, telemetry on what would break, and a per-tenant strict mode.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/620.html" }, { "@id": "https://cwe.mitre.org/data/definitions/757.html" }, { "@id": "https://cwe.mitre.org/data/definitions/636.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/620.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/757.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t2", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T2", "skos:prefLabel": { "@value": "Shared Infrastructure, Shared Fate", "@language": "en-GB" }, "skos:definition": { "@value": "Multi-tenant platforms pool identity, reputation and trust across customers who do not trust each other.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "The tenant boundary is enforced in the data layer and identity layer, not only in configuration.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Bind tenant identity at ingress and enforce it in every store, cache, queue and key store by construction.", "@language": "en-GB" }, { "@value": "Give each tenant its own keys, cache namespace, sending identity and verification tokens.", "@language": "en-GB" }, { "@value": "Test the boundary adversarially with a tenant that attempts to read, write, send as and configure another, and keep that test in the release pipeline.", "@language": "en-GB" }, { "@value": "Separate tenants' operational copies too (archive, index, backup, logs), not only their live mailboxes.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Partial", "skos:broadMatch": [ { "@id": "https://capec.mitre.org/data/definitions/124.html" }, { "@id": "https://cwe.mitre.org/data/definitions/653.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/124.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/653.html" } }, { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/#t1", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/taxonomies/email-infrastructure/" }, "skos:broader": { "@id": "https://ostering.com/taxonomies/email-infrastructure/structural-hazards/" }, "skos:notation": "T1", "skos:prefLabel": { "@value": "Check Once, Use Later", "@language": "en-GB" }, "skos:definition": { "@value": "Store-and-forward separates the moment of inspection from the moment of use, and content or context can change in between.", "@language": "en-GB" }, "ost:mitigationPrinciple": { "@value": "There is a control at the moment of use, not only at the moment of receipt.", "@language": "en-GB" }, "ost:designMeasure": { "@list": [ { "@value": "Evaluate links at click, re-scan on release and re-judge delivered mail when intelligence changes.", "@language": "en-GB" }, { "@value": "Re-verify standing conditions (domain ownership, session validity, sender reputation) periodically and on change events.", "@language": "en-GB" }, { "@value": "Record for every decision the conditions it depended on, so that a change in any of them can trigger re-evaluation of the decisions that relied on it.", "@language": "en-GB" } ] }, "ost:stride": [ { "@id": "https://ostering.com/ns/stride#Tampering" } ], "ost:strideFit": "Loose", "ost:capecMatch": "Direct", "skos:closeMatch": [ { "@id": "https://capec.mitre.org/data/definitions/29.html" } ], "ost:capecBestFit": { "@id": "https://capec.mitre.org/data/definitions/29.html" }, "ost:cweMatch": "Partial", "ost:cweBestFit": { "@id": "https://cwe.mitre.org/data/definitions/367.html" }, "skos:broadMatch": [ { "@id": "https://cwe.mitre.org/data/definitions/367.html" } ] }, { "@id": "https://ostering.com/ns/stride#", "@type": "skos:ConceptScheme", "dcterms:title": { "@value": "STRIDE threat categories", "@language": "en-GB" }, "skos:hasTopConcept": [ { "@id": "https://ostering.com/ns/stride#Spoofing" }, { "@id": "https://ostering.com/ns/stride#Tampering" }, { "@id": "https://ostering.com/ns/stride#Repudiation" }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure" }, { "@id": "https://ostering.com/ns/stride#Denialofservice" }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege" } ] }, { "@id": "https://ostering.com/ns/stride#Spoofing", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "S", "skos:prefLabel": { "@value": "Spoofing", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/stride#Tampering", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "T", "skos:prefLabel": { "@value": "Tampering", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/stride#Repudiation", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "R", "skos:prefLabel": { "@value": "Repudiation", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/stride#Informationdisclosure", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "I", "skos:prefLabel": { "@value": "Information disclosure", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/stride#Denialofservice", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "D", "skos:prefLabel": { "@value": "Denial of service", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/stride#Elevationofprivilege", "@type": "skos:Concept", "skos:inScheme": { "@id": "https://ostering.com/ns/stride#" }, "skos:topConceptOf": { "@id": "https://ostering.com/ns/stride#" }, "skos:notation": "E", "skos:prefLabel": { "@value": "Elevation of privilege", "@language": "en-GB" } }, { "@id": "https://ostering.com/ns/taxonomy#mitigationPrinciple", "@type": "rdf:Property", "rdfs:label": { "@value": "mitigationPrinciple", "@language": "en-GB" }, "rdfs:comment": { "@value": "What a sound design does about the threat, stated so that different designs can satisfy it in different ways.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#designMeasure", "@type": "rdf:Property", "rdfs:label": { "@value": "designMeasure", "@language": "en-GB" }, "rdfs:comment": { "@value": "An ordered list of concrete ways of satisfying the mitigation principle; examples, not the only acceptable answers.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#stride", "@type": "rdf:Property", "rdfs:label": { "@value": "stride", "@language": "en-GB" }, "rdfs:comment": { "@value": "The STRIDE categories the threat belongs to, best fit first.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#strideFit", "@type": "rdf:Property", "rdfs:label": { "@value": "strideFit", "@language": "en-GB" }, "rdfs:comment": { "@value": "Clean: a STRIDE prompt would plausibly find this threat. Loose: STRIDE gives a label but not the question that finds it.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#capecMatch", "@type": "rdf:Property", "rdfs:label": { "@value": "capecMatch", "@language": "en-GB" }, "rdfs:comment": { "@value": "The rating for the entry's CAPEC 3.9 patterns as a whole. Direct: the best-fit pattern (ost:capecBestFit) describes the threat, and the patterns are linked with skos:closeMatch. Partial: only a generic parent pattern applies, linked with skos:broadMatch. None: no pattern.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#cweMatch", "@type": "rdf:Property", "rdfs:label": { "@value": "cweMatch", "@language": "en-GB" }, "rdfs:comment": { "@value": "The rating for the entry's CWE 4.20 weaknesses as a whole. Direct: the best-fit weakness (ost:cweBestFit) names the flaw, and any others cover further aspects of it; all are linked with skos:closeMatch. Partial: only a broader or adjacent weakness applies, linked with skos:broadMatch. None: no CWE weakness names it.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#capecBestFit", "@type": "rdf:Property", "rdfs:label": { "@value": "capecBestFit", "@language": "en-GB" }, "rdfs:comment": { "@value": "The CAPEC pattern that fits the entry best, first of its list.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#cweBestFit", "@type": "rdf:Property", "rdfs:label": { "@value": "cweBestFit", "@language": "en-GB" }, "rdfs:comment": { "@value": "The CWE weakness that fits the entry best, first of its list; for a Direct match, the one that names the flaw.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#position", "@type": "rdf:Property", "rdfs:label": { "@value": "position", "@language": "en-GB" }, "rdfs:comment": { "@value": "The group's place in the sequence of layers or stations.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } }, { "@id": "https://ostering.com/ns/taxonomy#unit", "@type": "rdf:Property", "rdfs:label": { "@value": "unit", "@language": "en-GB" }, "rdfs:comment": { "@value": "What a group is in this taxonomy: a layer, a station, or the structural hazards.", "@language": "en-GB" }, "rdfs:isDefinedBy": { "@id": "https://ostering.com/ns/taxonomy#" } } ] }