## 7 Discussion of the Filtering Impact on Security and Privacy
### Influence of Filtering on STRIDE Attack Vectors  
At first, the influence of network filtering according to _Bark_ on the STRIDE attack vectors, as given in the Appendix A (see Table A1), is discussed. Because the effectiveness of filtering-based approaches highly depends on the rules which are in place to filter traffic, scenario-specific circumstances need to be considered. Therefore, scenario-specific adjustments of the influence ratings are discussed after the vector-specific discussions. _ARC_, _ASC_, _DRC_, _DSC_, _LRC_, _LSC_:  
During the analysis, it was identified that measures that restrict traffic only within the local network, or entering/leaving the home router, are not able to mitigate any login attempts on a remote server. There might be an influence on the process of stealing the credentials in the first place, e.g., if stolen using a local MitM attack (not applicable to admin passwords); but on the other hand, vectors like a leaked password database are invariant. (_DSC_ and _LSC_ only appear on servers other than the _Unessential server_; therefore, even if for the latter an influence is assumed, this does not apply to the servers for which those two attack vectors are relevant.) Therefore, again, the influence is rated as _no or only low_ for the attack vectors _ARC_, _ASC_, _DRC_ and _LRC_ but as _some_ for _DSC_ and _LSC_. _Dbo:_  
Similarly, the presence of vulnerabilities on the server side, like a database that is disclosed to the public or only weakly protected, is also out of scope for filtering approaches installed on the home router. Therefore, an influence rating of _no or only low_ is assigned for this vector (_DBO_). _Dil:_  
Filtering has no positive influence on logging, leading to a rating of _no or only low (DIL)_. _DNE, DNL, ENE, ENL, MNE, MNL:_  
Filtering rules cannot prevent an MitM from intercepting, eavesdropping on, or modifying traffic, but it can prevent an attacker from getting into a position suitable to perform MitM attack types. Then, we can conclude that the level of filtering influence is the same as for the MitM vector (_MME_ or _MML_) they are based on. Therefore, the influence on _DNE_, _ENE_ and _MNE_ is rated as _no or only low_, but a _medium_ rating is assigned for the _DNL_, _ENL_ and _MNL_ vectors. Note, following a defensive in-depth strategy, an additional end-to-end encryption with proper authentication of the endpoint [92] prevents a man-in-the-middle attacker from being able to directly read the traffic. However, even when communication is encrypted, _traffic analysis_[4; 5] can violate privacy. This attack can reveal information without the knowledge of the communication's contents. Of course, proper authenticated end-to-end encrypted channels are still too often neglected, so attackers can use MitM instead of having to perform more costly and potentially unsuccessful traffic analysis [93]. Still, even with encryption, such attacks may allow attackers to undermine the security of the person [8; 9; 10]. However, we conclude that filtering is helpful by preventing an attacker from getting into a position that would allow them to carry out the MitM as discussed above because this would at the same time prevent an attacker from being in the position to observe the traffic for a successful traffic analysis attack. _DOS:_  
The _Bark_ filtering approach can prevent DoS attack traffic if it is not whitelisted. However, there is a possibility that wired clients, which are not considered in the approach, can bypass the filtering mechanisms by spoofing their MAC addresses. There is also the possibility of indirectly targeting a victim via a device that already has network access and is additionally accessible to the attacker. [PERSON] et al. have shown that all eight devices they tested can be used to reflect TCP SYN attacks, and some of them even support high gain reflection [94]. Therefore, the impact is only rated as _some_ (_DOS_).