Component: Dedicated Hardware Firewall

Segments the SecureDrop Area from the workstations and the internet.

Threats Affecting This Component

Threat	Status	Risk	After mitigations	Mitigations
Firewall not up to date THREAT47	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
Firewall logs are not monitored THREAT149	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
Vulnerabilities/Compromise of Hardware Firewall THREAT48	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	mitigated	4 medium	2 low	Restrictive iptables rules on servers