FAIR Integration with TLCTC v2.0

Current State Analysis

FAIR's Strengths

• Strong quantitative risk analysis methodology with established loss magnitude calculations
• Clear framework for calculating loss magnitude across primary and secondary loss forms
• Established approach to control effectiveness evaluation
• Proven methodology for risk prioritization and Monte Carlo simulation

FAIR's Limitations

• Lacks explicit, standardized threat categorization taxonomy
• Struggles with modeling complex, multi-stage attack sequences
• Limited ability to represent parallel threat execution
• No temporal dimension for defender response window analysis
• Difficulty in modeling threat interdependencies and domain boundary crossings
• No structured separation of causes (threats) from consequences (outcomes)

TLCTC v2.0's Complementary Capabilities

• Precise threat categorization through 10 non-overlapping clusters (#1–#10) based on generic vulnerabilities
• Strategic (#X) and Operational (TLCTC-XX.YY) notation layers for different audience needs
• Attack Velocity (Δt) annotations measuring time between attack steps
• Four Velocity Classes (VC-1 to VC-4) mapping to defender response capabilities
• Domain Boundary Operators ||[context][@Source→@Target]|| for responsibility mapping
• Data Risk Event (DRE) tags separating causes from consequences (C/I/A)
• Nine R-* classification rules ensuring consistent threat mapping
• Bridge clusters (#8, #9, #10) and Internal clusters (#1–#7) topology

TLCTC v2.0 Notation Reference

Before diving into FAIR integration, understanding TLCTC v2.0's enhanced notation is essential. The framework now provides comprehensive attack path documentation capabilities.

Attack Path Notation

Velocity Classes

Velocity Classes map Δt ranges to defender response capabilities. This is a critical enhancement for FAIR integration—it determines which control types are structurally viable for a given attack transition.

Enhanced Integration Framework

1. Risk Quantification Enhancements

TLCTC v2.0 provides four key enhancements to FAIR's risk quantification methodology:

SCF = f(path_length, parallel_groups, velocity_variance)

CTM(#X + #Y) = 1 + synergy_factor(X, Y)

VWCE(control, transition) = base_effectiveness × VC_applicability_factor

Total_Risk = Σ(Path_Risk_i × Path_Probability_i)

2. Implementation Framework

The following phases integrate TLCTC v2.0 analysis into the FAIR methodology:

Real-World Application: SCATTERED SPIDER

The following example demonstrates TLCTC v2.0 notation applied to a documented identity-driven attack, incorporating all v2.0 enhancements including velocity annotations, domain boundaries, and DRE outcome tags.

Attack Path (Full v2.0 Notation)

#9 ||[human][@External→@Org(HelpDesk)]|| →[Δt<1m] #4 →[Δt=2-5m] #1 →[Δt=hours] #4 →[Δt<24h] #7 + [DRE: C, A]

Step-by-Step Analysis

FAIR Enhancement Application

# Apply SCF for 5-step sequence
SCF = base_factor × (1 + log(path_length)) × velocity_variance_penalty

# Apply VWCE — key insight from v2.0:
# The #9→#4 transition at VC-4 velocity means:
#   - Human-dependent controls (awareness training) = ~0% effective
#   - Only architectural controls matter at this transition

# Domain boundary insight:
# ||[human][@External→@Org(HelpDesk)]|| identifies help desk as attack surface

Control Effectiveness by Velocity Class

A critical v2.0 insight: control effectiveness is not absolute—it varies by Velocity Class. The Layer 4 specification organizes controls through a three-tier hierarchy: NIST CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) as strategic objectives, FAIR-CAM v1.0 domains (Prevention, Detection, Response) as analytical categories, and VWCE ratings per Velocity Class for structural viability. The following matrix provides calibration guidance:

Benefits of v2.0 Integration

1. More Accurate Risk Quantification:
   • Velocity-weighted control effectiveness prevents overestimating defenses against fast attacks
   • Domain boundary annotations identify responsibility gaps and handoff risks
   • DRE separation ensures clean cause-consequence analysis
2. Improved Control Evaluation:
   • R-* rules ensure consistent threat-to-cluster mapping across analyses
   • Velocity Classes reveal which control types are structurally viable
   • Bridge/Internal cluster topology guides control placement
3. Enhanced Communication:
   • Strategic (#X) notation for executive reporting
   • Operational (TLCTC-XX.YY) notation for technical teams
   • Velocity annotations translate to defender response requirements
4. Better Resource Allocation:
   • VWCE guides investment toward controls effective at observed velocities
   • Responsibility sphere mapping identifies accountability gaps
   • Path variance analysis prioritizes highest-likelihood attack routes

Layer 4: Risk Quantification Schema

The TLCTC-FAIR integration is formalized as Layer 4 in the TLCTC JSON architecture — a new machine-readable schema that bridges Layer 3 attack path analysis with FAIR risk quantification:

Layer 4 instances reference Layer 3 attack paths and enrich them with FAIR factor estimates using standard distributions — Beta-PERT for frequency (min/mode/max/confidence), lognormal for magnitude (5th/95th percentile) — ensuring compatibility with existing FAIR tooling. The schema models the complete FAIR decomposition tree (FAIR Model v3.0), maps controls through NIST CSF 2.0 → FAIR-CAM v1.0 → VWCE, and captures all four TLCTC enhancement factors per transition.

Final Risk Calculation

The enhanced FAIR risk score integrates TLCTC v2.0 factors:

Enhanced_FAIR_Risk = f(Base_FAIR_Risk, SCF, CTM, PVA, VWCE)

Adjusted_LEF = Base_LEF × SCF × Σ(CTM_i)
Adjusted_LM  = Base_LM × VWCE_impact_factor
Total_Risk   = Σ(Adjusted_LEF_j × Adjusted_LM_j × path_probability_j)

Where:

• SCF: Sequence Complexity Factor — reduces LEF based on path length, parallel groups, and velocity variance
• CTM: Compound Threat Multipliers — synergy/interference factors for parallel cluster execution
• PVA: Path Variance Analysis — weighted aggregation across alternative attack routes
• VWCE: Velocity-Weighted Control Effectiveness — per-transition control viability (base_effectiveness × vc_applicability)