Threat Modeling vs Information Classification

The report argues that information-centric security is impractical in real-world environments due to shared data containers, attacker pivoting, and the criticality of system functionality beyond data sensitivity. It recommends prioritization based on threat-centric models, system/network trust segmentation, and attacker movement simulation, noting current limitations like immature DRM and data scarcity, with preliminary consideration of integrating VERIS metrics.