Threat model for "SecureDrop"

Component: Application Server (host)

Defined in model.py:366

The app server hardware/OS/host firewall beneath the SecureDrop services.

Threats Affecting This Component

Threat	Status	Risk	After mitigations	Mitigations
SecureDrop server identification THREAT93	out of scope	8 high	8 high
App server supply chain attack THREAT99	inform	6 medium	6 medium
App server (physical) tampering THREAT107	partially mitigated	6 medium	6 medium	Swap disabled on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; Nighly reboot occurs to clear secrets stored in memory
Firmware exploits/ME exploits for application server THREAT110	accepted	6 medium	6 medium
App server seized THREAT147	partially mitigated	4 medium	4 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Use of airgapped SVS key; Nighly reboot occurs to clear secrets stored in memory; Swap disabled on servers
Firewall rule misconfiguration on application server THREAT31	partially mitigated	9 high	3 low	Use of Ansible for configuration management for servers; Use of external dedicated hardware firewall
Unknown vulnerabilities in the Linux Kernel THREAT40	partially mitigated	6 medium	3 low	Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Known vulnerabilities in the Linux kernel or packages used by app/mon servers THREAT41	mitigated	6 medium	3 low	Automatic updates on servers; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Ubuntu ISO malicious THREAT43	inform	6 medium	3 low	Install process instructs admins to validate sig on Ubuntu ISO
No mitigation or revocation for compromised key THREAT172	partially mitigated	6 medium	3 low	Use of airgapped SVS key; Persistent storage FDE for SVS; Users instructed not to move the SVS key off the SVS workstation

Scenarios Using This Component

Physical and host layer

Back to Components List | Back to Summary