Threat model and management isolation

Why this matters in production

Security controls that don’t address real threats are theatre. A threat model forces explicit choices about what to defend, against whom, and at what cost.

Mental model

A threat model answers four questions:

1. What are we protecting? (Assets)
2. Who are we protecting it from? (Threat actors)
3. What can they do? (Capabilities)
4. What is the impact if they succeed? (Consequences)

Without answers, security investments are guesswork.

flowchart LR
  A[Assets] --> B[Threat model]
  T[Threat actors] --> B
  C[Capabilities] --> B
  I[Impact] --> B
  B --> D[Controls]

Proxmox assets

Threat actors

Management-plane isolation

The management UI/API/SSH is the crown jewel. Threats to it:

• Credential theft.
• Network exposure (a misconfigured firewall or accidentally-public IP).
• Privilege escalation.
• Supply chain (a compromised update).

Controls:

Production considerations

Common mistakes

• “We’re too small to be a target.” (You’re not too small to be scanned.)
• “Internal network is safe.” (Most breaches are insider-driven.)
• “MFA is too inconvenient.” (Try recovering from a stolen password.)

Key takeaways

• Build a threat model before designing controls.
• Management-plane isolation is the highest-impact control.
• Insiders are the most likely threat.

Knowledge check