Threat model for "SecureDrop"

Component: SecureDrop Application

Defined in model.py:166

Encrypts each submission to the instance public key; plaintext is transient.

boundary: Application Server handles source identity is hardened logs actions processes untrusted input runs app code transient plaintext uses network

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Configuration vulnerability in Source interface THREAT5 partially mitigated 9 high 9 high Config managed by securedrop-client sdconfig CLI tool
Application server configuration error THREAT169 partially mitigated 9 high 6 medium Use of Ansible for configuration management for servers
Configuration vulnerability in Journalist interface THREAT9 mitigated 6 medium 6 medium Config managed by securedrop-client sdconfig CLI tool
HTTP security configuration vulnerability in Source interface THREAT23 mitigated 4 medium 4 medium Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Source interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self
HTTP security configuration vulnerability in Journalist interface THREAT27 mitigated 4 medium 4 medium Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Journalist interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self

Scenarios Using This Component

Back to Components List | Back to Summary