security thru acronyms

[Raoul Duke]

"For some security backgrounder - OSSTMM is a universal security model that works from first principles so it applies equally to locking the door to your house as it does penetration testing of a network system deployment. There are really 3 grades of "assurance" in claiming that something is secure (see Part III of the paper): asserted - something established by a policy document, tested - something measured empirically, and decided - something that is an innate property of the object."

https://www.isecom.org/

[Rob Meijer]

On Mon, 9 Nov 2026, 18:05 Raoul Duke, <rao...@gmail.com> wrote:

"For some security backgrounder - OSSTMM is a universal security model that works from first principles so it applies equally to locking the door to your house as it does penetration testing of a network system deployment. There are really 3 grades of "assurance" in claiming that something is secure (see Part III of the paper): asserted - something established by a policy document, tested - something measured empirically, and decided - something that is an innate property of the object."

https://www.isecom.org/

Seems I'm getting old. I remember that I contributed to an early version of the OSSTMM with (a) section(s) about testing subsystems for undesired access to other subsystems (reduced authority at the infra component level of granularity). But when I look at the 3.0 version index, I can't for the life of me find what exactly I contributed.

I do remember later having major issues with the early version of the Risk Assessment metrics because of the problem with dividing by highly uncertain values leading to underestimated risk unless values divided by are modeled as probability density functions. Again I remember discussing my issues with Pete, but my brain is abandoning me when it comes to remembering if any of my concerns ended up being addressed.

--
You received this message because you are subscribed to the Google Groups "cap-talk" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cap-talk+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/cap-talk/CAJ7XQb6dAL1_Jm01rK40npX%3DmD7P9hfhOiGBkWZKYgxuv-%2BVhw%40mail.gmail.com.