Threat model for "SecureDrop"

Component: sys-firewall

Defined in model.py:466

Qubes service VM that filters network traffic. sd-proxy reaches the network through it.

boundary: Workstation VMs

Threats Affecting This Component

Threat Status Risk After mitigations Mitigations
Known vulnerability in any VM template THREATQW22 mitigated 12 high 6 medium Autoupdate all VMs; grsecurity in all Debian templates
Malicious VM template THREATQW28 mitigated 6 medium 6 medium
Side-channel analysis or exfiltration of GPG keys or other sensitive data THREATQW29 partially mitigated 6 medium 6 medium Use non-networked disposible VMs for opening all decrypted files.
Admin error in provisioning of the workstation THREATQW31 inform 6 medium 6 medium
Vulnerability introduced to AppVMs via Template dependency THREATQW58 partially mitigated 6 medium 6 medium grsecurity in all Debian templates; create individual templates for each role in workstation to minimize unnecessary package installs
Attacker obtains code execution in any VM THREATQW36 partially mitigated 6 medium 4 medium Default Qubes-RPC deny policy; grsecurity in all Debian templates
Information disclosure (Xen vulnerability) THREATQW21 accepted 4 medium 4 medium
User error while operating the workstation THREATQW19 partially mitigated 9 high 3 low
Unknown vulnerability in a VM template THREATQW10 mitigated 6 medium 3 low grsecurity in all Debian templates
Privilege escalation (Xen vulnerability) THREATQW11 accepted 6 medium 3 low grsecurity in all Debian templates
DoS (Xen vulnerability) THREATQW3 accepted 2 low 2 low
Attacker obtains code execution in the Firewall VM THREATQW4 partially mitigated 2 low 2 low
Compromised VM spoofs log origin THREATQW56 accepted 2 low 2 low
Inter-vm covert channels (e.g. CPU cache) used for exfiltration THREATQW48 accepted Unknown Unknown

Scenarios Using This Component

Back to Components List | Back to Summary