Model internals

Views for the people who write the model. They show how threats are matched to components, whether listed by name or found through component properties, which helps check that each rule fires where it should. Readers looking for risk should start from the threats instead.

• Matching rules: which component properties each threat's requirements use.
• Threats × components matrix: every threat that applies, against every component it applies to.
• Component properties: which properties each component has.

Component properties

• client auth Onion requires client authentication (v3 client-auth / ATHS).
• encrypts alerts Encrypts alerts (admin GPG key) before sending. [mitigates I]
• encrypts at rest Encrypts stored data (instance GPG pubkey). [mitigates I]
• fetches updates Pulls code/packages/time from outside. [T, supply chain]
• handles source identity Sees data that could identify/correlate a source. [I]
• holds decryption key Holds the submission private key able to recover plaintext. [I]
• is exposed Reachable by an untrusted attacker.
• is hardened Sandboxed/confined (AppArmor, seccomp, minimal services). [mitigates T,E]
• is removable media Physical removable media bridging trust zones.
• is tor onion Published as a Tor onion service.
• logs actions Writes an audit log of privileged actions. [mitigates R]
• processes untrusted input Parses input from an anonymous/untrusted party. [T,E,D]
• publishes code Publishes code/packages consumed by others.
• rate limited Has anti-abuse / rate limiting on its exposed surface. [mitigates D]
• removes metadata Sanitizes documents (strips identifying metadata).
• requires credentials Requires credentials to access. [S]
• runs app code Executes SecureDrop application code.
• segments network Enforces network segmentation between zones.
• sends alerts Emits operational alerts to operators. [I]
• stores submissions Holds source submissions at rest. [I]
• transient plaintext Handles submission plaintext in memory, even briefly. [I]
• uses network Speaks to the network stack.
• uses strong credentials Credentials are 2FA (passphrase + TOTP/HOTP). [mitigates S]
• verifies signatures Verifies signatures on what it fetches. [mitigates T]