D3fend Model

D3FEND — Model

When to Use

• Building or auditing asset inventories (hardware, software, network, data)
• Mapping network topology and logical/physical links
• Running vulnerability assessments and enumerating exposures
• Modeling operational dependencies and service mappings
• Assessing organizational cyber risk posture
• Analyzing container images and configurations

When NOT to Use

• Implementing hardening controls → d3fend-harden
• Designing detection rules or monitoring → d3fend-detect
• Network segmentation or access mediation → d3fend-isolate
• Incident response or eviction actions → d3fend-evict
• General enterprise security program design → cybersecurity

Core Workflows

1. Asset Inventory

See `references/asset_inventory.md`

2. Network Mapping

• Logical: Layer 3 topology, routing paths, traffic policies
• Physical: Cable runs, rack layouts, wireless coverage
• Active: Scanning, probing, traceroute
• Passive: NetFlow, ARP tables, DHCP logs

See `references/network_mapping.md`

3. Vulnerability Assessment

1. Discovery → asset inventory 2. Scanning → Nessus, Qualys, OpenVAS 3. Analysis → CVSS scoring, exploitability, exposure 4. Prioritization → threat intel, asset criticality 5. Reporting → remediation timelines

See `references/vulnerability_assessment.md`

4. Dependency & Risk Mapping

• Service dependencies: upstream/downstream services
• Operational: business process → IT asset mapping
• Data exchange: flows, interfaces, protocols
• Access modeling: who can access what

See `references/dependency_risk_mapping.md`

When to load references

• Asset inventory → references/asset_inventory.md
• Network mapping → references/network_mapping.md
• Vulnerability assessment → references/vulnerability_assessment.md
• Dependency & risk mapping → references/dependency_risk_mapping.md

Asset Inventory

Technique Coverage

Implementation

Discovery Methods

CMDB Structure

Asset:
  id: unique_identifier
  type: [hardware|software|network|data|container]
  name: descriptive_name
  owner: team_or_person
  location: physical_or_cloud_region
  criticality: [critical|high|medium|low]
  compliance_scope: [PCI|HIPAA|SOX|etc]
  lifecycle: [active|maintenance|retired]
  vulnerabilities: []  # linked findings
  dependencies: []    # upstream/downstream

Tools

• Lansweeper, ServiceNow CMDB
• Nmap, OpenVAS
• osquery, FleetDM
• Trivy, Docker Scout
• CloudMapper, Prowler

SBOM Integration

• Generate SBOMs for all software
• Link SBOM components to vulnerabilities
• Track transitive dependencies
• Update on every release

Dependency & Risk Mapping

Technique Coverage

Mapping Types

Service Dependencies

Service A → depends on → Service B (API)
Service B → depends on → Database C
Database C → hosted on → Server D

Tools: ServiceNow, Dynatrace, Jaeger, dependency graphs

Data Exchange Mapping

Source: CRM
Destination: Data warehouse
Method: ETL pipeline
Data: Customer PII
Frequency: Daily
Encryption: TLS + AES at rest

Access Modeling

User: finance_team
Can access: erp_system, reports_share
Cannot access: prod_db, admin_panel
MFA required: yes
Approval: manager + security

Risk Assessment

Network Mapping

Technique Coverage

Mapping Methods

Logical Topology

Discovery: SNMP, LLDP, CDP, routing tables
Visualization: Layer 3 diagram with subnets, VLANs, routers
Update frequency: Weekly or on change

Physical Topology

Discovery: Cable tracing, port mapping, DCIM tools
Visualization: Rack elevation, cable runs, power paths
Update frequency: As-built after changes

Traffic Policy Mapping

Sources: Firewall configs, cloud security groups, ACLs
Checks: Shadowed rules, overly permissive rules, unused rules
Frequency: Monthly review

Tools

• Nmap, Masscan
• NetBox, phpIPAM
• Cisco Prime, SolarWinds
• CloudMapper, Cartography

Vulnerability Assessment

Technique Coverage

Assessment Process

1. Discovery

• Align with asset inventory
• Identify scan targets and exclusions
• Schedule scanning windows

2. Scanning

3. Analysis

• Deduplicate findings
• Correlate with threat intel (exploitability)
• Score with CVSS + asset criticality
• False positive review

4. Prioritization

5. Reporting

• Executive summary (risk trend)
• Technical detail (findings per asset)
• Remediation tracker