ostering.com
  • Threat Taxonomies
    • Email Infrastructure Threat Taxonomy
      • Delivery pipeline (DP)
      • Authentication protocols (AU)
      • Client protocols (CP)
      • SMTP (SM)
      • MIME and S/MIME (MI)
      • DNS layer (DN)
      • Content scanners (CS)
      • Human-facing layer (HF)
      • Operations and storage (OP)
      • Structural hazards (T)
    • Software Factory Threat Taxonomy
      • Line 1
        • Workstation and Agents (WS)
        • Version Control (VC)
        • Pipeline Definition (PD)
        • Runners (RN)
        • Pipeline Identity and Secrets (ID)
        • Build Systems (BS)
        • Dependency Resolution (DR)
        • Scanners and Gates (SG)
        • Provenance and Attestation (PV)
      • Line 2
        • Registries (RG)
        • Firewall and Quarantine (FW)
        • SBOM and VEX (BM)
        • Infrastructure as Code (IC)
        • Container Images (IM)
        • Container Runtime (RT)
        • Orchestration (OR)
        • Delivery and Deployment (DL)
      • Structural hazards (T)
    • Care Assistant Threat Taxonomy
      • Sensing (SN)
      • Sight and Sound (AV)
      • Interpretation (IN)
      • Alerting (AL)
      • Response (RS)
      • Care Circle (CC)
      • Resident (RE)
      • Data and Inference (DA)
      • Lifecycle (LC)
      • Structural hazards (T)
    • Smart Home Threat Taxonomy
      • Hub and Bridges
      • Radio and Mesh
      • Domotics
      • Cameras and Doorbells
      • Alarms and Locks
      • Appliances
      • Energy
      • Home Network
      • Vendor Cloud
      • Remote Control
      • Voice and Automations
      • Household
      • Lifecycle
      • Structural Hazards
    • Critical Infrastructure (Cyberwarfare) Threat Taxonomy
      • The Campaign
        • Reconnaissance and Mapping (RM)
        • Pre-positioning (PP)
        • Service Chain (SC)
        • Process Effects (PE)
        • Scale and Timing (ST)
        • Recovery Denial (RD)
        • Aftermath and Deniability (AD)
        • Air and Spectrum (AS)
      • The Estate
        • Field Devices and Controllers (FD)
        • Control Centre and SCADA (CC)
        • Fleet Management Platforms (FM)
        • Remote and Vendor Access (RA)
        • Telecoms and Timing (TT)
        • Logistics and Supply (LS)
        • Transport Networks (TN)
        • Interdependencies (IX)
        • Interdependencies (IX)
      • Structural hazards (BKS-TR)
    • AI and Agentic Systems Threat Taxonomy
      • ♠ Spades: Adversarial
      • ♥ Hearts: Autonomy
      • ♦ Diamonds: Data
      • ♣ Clubs: Privacy
      • ★ Trumps: Structural Hazards
    • Hospital and Medical Device Threat Taxonomy
      • The Patient
        • Implants and Programmers (IM)
        • Body-worn and Home-use Devices (BW)
        • Patient Monitoring (PM)
        • Life Support and Therapy (LS)
        • Medication Delivery (MD)
        • Imaging and Radiation (IR)
        • Laboratory and Diagnostics (LD)
        • Clinical Software and AI (CA)
      • The Hospital
        • Records and Patient Data (RC)
        • Integration and Interoperability (IN)
        • Networks and Wireless (NW)
        • Clinical Communications (CC)
        • Emergency and External Communications (EC)
        • Facilities and Building Systems (FB)
        • Suppliers, Service and Lifecycle (SV)
        • Identity and Access (AC)
        • Continuity and Downtime (CD)
      • Structural hazards (TR)
  • Threat Modeling
  • Supply Chain Security
  • AI Security
  • Posts
  • Talks
  • Privacy

Tagged in: SMTP (1)

Elevation of Email Flow, a threat modeling card game for email infrastructure. Five cards from the deck fanned on an airmail envelope: Ingress Bypass, DKIM Replay, SMTP Smuggling, Scanner Prompt Injection and Envelope and Header Duality.

Elevation of Email Flow Launch

Threat modeling the machinery that delivers email TL;DR:...

November 5, 2026

Browse all Topics

  • Agentic AI
  • AI Security
  • Application Security
  • Auth
  • AWS
  • CAPEC
  • Catasto
  • Change
  • Claude Code Security
  • Cloud Security
  • Compliance
  • CRA
  • Critical Infrastructure
  • Cryptography
  • Culture
  • Cursor AI
  • CWE
  • Cybersecurity
  • Cyberwarfare
  • Dark Patterns
  • DevSecOps
  • DIY
  • DKIM
  • DORA
  • Elevation of Privilege
  • Email Security
  • Games
  • Garden Wildlife
  • Graph Analysis
  • Healthcare Security
  • Hedgehog
  • Inner-Source
  • IoT Security
  • Java
  • JavaScript
  • KMS
  • languages
  • learning
  • LINDDUN
  • Medical Devices
  • Miro
  • Mitre
  • Model Context Protocol
  • NIS2
  • Open-Source
  • Origins
  • Osteria
  • OT Security
  • OWASP
  • Post Quantum Cryptography
  • Privacy
  • Privacy by Design
  • Python
  • Risk
  • Running
  • SAST
  • SBOM
  • scarno
  • Secure by Design
  • Security
  • Security by Design
  • Security Culture
  • Security Maturity
  • SLSA
  • Smart Home
  • SMTP
  • Social Engineering
  • Software Architecture
  • Software Design
  • Software Development
  • Software Engineering
  • Software Quality
  • src2sink
  • Strategy
  • STRIDE
  • Supply Chain Security
  • Technical Dept
  • Threat Modeling
  • Threat Taxonomy
  • TRIM
  • Woodworking
ostering.com

{Osteria}{Running}

Copyright 2026 Brett Crawley

 

This website uses cookies
Select which cookies to opt-in to via the checkboxes below; our website uses cookies to examine site traffic and user activity while on our site, and to provide social media functionality. Privacy Policy
Cookie settings
We use cookies to enhance your browsing experience, serve content, and analyze our traffic. By clicking "Accept All", you consent to our use of cookies. Privacy Policy
  • Required

    These cookies are used to enhance your browsing experience, and serve content.

  • analytics

    Our site anonymizes all of its tracking data, making it fully GDPR-compliant