D3FEND Matrix Design Heuristic

[netfl0]

D3FEND Matrix Design Heuristic

The D3FEND Matrix is a visualization of the ontology. We have competing priorities, visual simplicity and orienting new users against ontological completeness.

The direct subclasses of DefensiveTechnique make up the matrix columns under the DefensiveTactics.

Initial Category Development

Each of these techniques are oriented to a specific technical domain such that:

1. A domain comprises people and the technologies they develop and or operate.
2. People can deeply specialize in each of these domains.
3. It would not be reasonable to expect a single person to deeply understand more than 5 of these domains.

Category Refinement to Address Problems

1. Profusion of top-level classes: if one particular domain is shallow, and has fewer than 3 categories, fit it into its best mereological parent. E.g. d3f:FileEncryption rdfs:subClassOf d3f:PlatformHardening
2. Esoteric technique proposal: if the technique is not broadly employed or understood, fit it into the most similar technique's kb-article
3. Direct vs indirect Digital Artifacts: E.g. if you want to evict an Agent, consider that:

       Agent -has-> UserAccount 
       Agent -has-> Credential
   

   Most technology will evict the credential, which will deny the Agent access to the UserAccount and its associated resources. Thus, for D3FEND, we'd model CredentialEviction. Evicting the Agent is implied.

[netfl0]

invite @ryantxu1 @hack-sentinel @