Threat model for "SecureDrop"

Component: SecureDrop source repository

Defined in model.py:316

GitHub source repository for SecureDrop.

Threats Affecting This Component

Threat	Status	Risk	After mitigations	Mitigations
Vulnerabilities maliciously introduced in python libraries THREAT86	partially mitigated	9 high	9 high	Dependencies are kept to a minimum and only commonly used dependencies are used in SecureDrop; Hashes of dependencies are stored in source control.; Python wheels rebuilt from source tarballs at debian package build time.
Supply chain attack on Python dependencies, e.g. developer of Python dependency uploads malicious source or binary release (either intentionally or accidentally), PSF PyPI is compromised THREATQW35	mitigated	9 high	9 high
Known exploitable vulnerabilities in Python or libraries used by SecureDrop THREAT34	mitigated	9 high	6 medium	Wheels shipped in deb package (i.e. no pip install -r requirements.txt in prod); Python dependencies are updated when a CVE is present; Python wheels rebuilt from source tarballs at debian package build time.
Github is compomised THREAT50	accepted	6 medium	6 medium	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; Airgapped signing for release tags, public and controlled branches for development/release; 2FA required for SD maintainer GitHub accounts; All code is reviewed prior to merge; SecureDrop code is open source
Malicious code introduced in SecureDrop repository THREAT28	mitigated	6 medium	3 low	All SecureDrop and tor releases (Release file and tag) signed with airgapped key; Airgapped signing for release tags, public and controlled branches for development/release; 2FA required for SD maintainer GitHub accounts; All code is reviewed prior to merge; SecureDrop code is open source

Scenarios Using This Component

Supply chain and dependencies

Back to Components List | Back to Summary