Threat model for "SecureDrop"

Component: Journalist Interface

Defined in model.py:141

Authenticated Flask app (client-auth onion) for triage.

boundary: Application Server client auth handles source identity is exposed is hardened is tor onion logs actions rate limited requires credentials runs app code uses network uses strong credentials

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Segmentation between Journalist and Source interfaces THREAT6 partially mitigated 9 high 6 medium Apache configured to expose source interface only via app-source-ths and journalist interface via app-journo-aths
Session management vulnerability in Journalist interface THREAT7 mitigated 6 medium 6 medium Use of Flask session management; Session timeout on both interfaces; Journalist interface: Set-Cookie ^(.*)$ $;HttpOnly; All session data deleted upon logout except language so the logout messages can be localized; Sources instructed to restart browser or clear the session to delete session cookie; HidServAuth token on journalist interface
Malicious input vulnerability in Journalist interface THREAT8 mitigated 6 medium 6 medium X-XSS-protection, CSP set to self; SQLAlchemy as an ORM; Use of Flask/Jinja for templating escaping; HidServAuth token on journalist interface
Authentication vulnerability in Journalist interface THREAT13 mitigated 6 medium 4 medium Passphrases are stored salted and hashed; 2FA token required for login to admin or journalist interfaces; ATHS token for Journalist Interface and API; Passphrases for journalists and admins are generated to be 7 word diceware; Journalist logins are throttled; Routes login protected by default on journalist interface
Access control vulnerability in Journalist interface THREAT14 mitigated 4 medium 4 medium Journalist interface is one big inbox (makes for simple logic); Only 2 roles in journalist / admin interface; CSRF from Flask used
Data protection vulnerability in Journalist interface THREAT15 mitigated 4 medium 4 medium Source interface: Cache-Control nostore; Sensitive data sent in POST requests
Communications vulnerability in Journalist interface THREAT17 mitigated 4 medium 4 medium Journalist interface only available as a Tor onion service
File and resource vulnerability in Journalist interface THREAT18 partially mitigated 4 medium 4 medium No external URL redirection; Untrusted uploaded data is directly encrypted and not executed; Journalist guide has cursory explanation of malware risks
Error handling and logging vulnerability in Journalist interface THREAT26 mitigated 4 medium 4 medium Debugging is disabled; Journalist interface: Sensitive information is not logged
Business Logic vulnerability in Journalist interface THREAT146 partially mitigated 4 medium 4 medium Journalist interface business logic is simple
Journalist user performs malicious action under another user's account THREAT170 out of scope 4 medium 4 medium 2FA token required for login to admin or journalist interfaces; Persistent storage FDE for Journalist Workstation
Journalist interface is framed THREAT33 mitigated 6 medium 3 low X-FRAME-OPTIONS DENY HTTP header; HidServAuth token on journalist interface
Web services vulnerability in Journalist interface THREAT82 mitigated 4 medium 2 low Journalist interface business logic is simple; ATHS token for Journalist Interface and API
Journalist user marks all submissions as seen THREAT171 out of scope 2 low 2 low

Scenarios Using This Component

Back to Components List | Back to Summary