Threat model for "SecureDrop"

Mitigations

Every mitigation in the model. Proposed mitigations are ranked by the risk they would reduce on the backlog.

296 mitigations
Status
AppArmor on Tor MITIG1 implemented 7 threats None
AppArmor on Apache MITIG2 implemented 7 threats None
HidServAuth token on journalist interface MITIG3 implemented 4 threats None
HidServAuth token on SSH MITIG4 optional 3 threats 1 threat
Use of OSSEC monitoring software MITIG5 implemented 7 threats None
Support for HTTPS on source interface MITIG6 optional 1 threat 3 threats
Use of ORM for SQL queries MITIG7 implemented None None
Use of Tails OS for Admin Workstation MITIG8 implemented None None
Use of Tails OS for Journalist Workstation MITIG9 implemented None None
Use of airgapped SVS key MITIG10 implemented 6 threats None
Use of strong encryption key for encrypted documents MITIG11 implemented 1 threat None
Persistent storage FDE for Admin Workstation MITIG12 implemented 1 threat None
Persistent storage FDE for Journalist Workstation MITIG13 implemented 4 threats None
Persistent storage FDE for SVS MITIG14 implemented 3 threats None
Passphrase on admin SSH key MITIG15 proposed None None
CSRF token on all forms on both interfaces MITIG16 implemented None None
Session timeout on both interfaces MITIG17 implemented 2 threats None
Sources instructed to restart browser or clear the session to delete session cookie MITIG18 implemented 2 threats None
2FA token required for login to admin or journalist interfaces MITIG19 implemented 3 threats None
SSH password auth disabled, requires key MITIG20 implemented 2 threats None
Use of external dedicated hardware firewall MITIG21 implemented 3 threats None
Require trusted location for hosting the physical servers MITIG22 implemented None None
App and monitor servers are dedicated physical machines, not VMs MITIG23 implemented None None
Landing page must have HTTPS by default MITIG24 implemented 1 threat None
Landing page must have no mixed content MITIG25 implemented 1 threat None
Landing page may support PFS MITIG26 implemented None None
No third party trackers, analytics, or ads on the landing page MITIG27 implemented 1 threat None
.onion addresses not links on the landing page MITIG28 implemented 1 threat None
Direct links to securedrop.org and freedom.press strongly discouraged on landing page MITIG29 implemented 1 threat None
Landing page: Cache-Control "max-age=0, no-cache, no-store, must-revalidate" MITIG30 implemented None None
Landing page: Set-Cookie ^(.*)$ $;HttpOnly MITIG31 implemented None None
Landing page: Pragma "no-cache" MITIG32 implemented None None
Landing page: Expires "-1" MITIG33 implemented None None
Landing page: always append X-Frame-Options: DENY MITIG34 implemented 1 threat None
Landing page: X-XSS-Protection: "1; mode=block" MITIG35 implemented None None
Landing page: X-Content-Type-Options: nosniff MITIG36 implemented None None
Landing page: X-Download-Options: noopen MITIG37 implemented None None
Landing page: X-Permitted-Cross-Domain-Policies: master-only MITIG38 implemented None None
Landing page: Content-Security-Policy: "default-src 'self'" MITIG39 implemented None None
Landing page: Referrer-Policy "no-referrer" MITIG40 implemented None None
Logging off for source interface MITIG41 implemented 3 threats None
Guidelines for OPSEC in the landing page MITIG42 optional 5 threats 1 threat
Automatic updates on servers MITIG43 implemented 1 threat None
Source account does not display their submitted documents MITIG44 implemented 2 threats None
Source codename is 7 word diceware passphrase MITIG45 implemented 3 threats None
All SecureDrop and tor releases (Release file and tag) signed with airgapped key MITIG46 implemented 6 threats None
All code is reviewed prior to merge MITIG47 implemented 3 threats None
Python dependencies are updated when a CVE is present MITIG48 implemented 1 threat None
Passphrases for journalists and admins are generated to be 7 word diceware MITIG49 implemented 4 threats None
Passphrases are stored salted and hashed MITIG50 implemented 1 threat None
Forms use WTForms validators MITIG51 implemented 2 threats None
Swap disabled on servers MITIG52 implemented 2 threats None
Use of grsecurity-hardened kernels on servers MITIG53 implemented 7 threats None
Source interface only available as a Tor onion service MITIG54 implemented 8 threats None
Journalist interface only available as a Tor onion service MITIG55 implemented 6 threats None
Not needed kernel modules are removed MITIG56 implemented None None
Persistent FDE Storage of Transfer Device MITIG57 Legacy (Tails/SVS) implemented 4 threats None
Persistent FDE Storage of Admin Tails Key MITIG58 Legacy (Tails/SVS) implemented 2 threats None
Password recovery is a manual process (admin or journalist via Journalist Interface or SSH) MITIG59 implemented None None
ATHS token for connecting to servers via SSH MITIG60 optional 1 threat None
Use of Ansible for configuration management for servers MITIG61 implemented 5 threats None
Instruct admins not to modify config by hand MITIG62 proposed None 7 threats
Use of Flask session management MITIG63 implemented 2 threats None
Use of Flask/Jinja for templating escaping MITIG64 implemented 2 threats None
securedrop-admin script to audit config of running servers MITIG65 proposed None 5 threats
Secure cookie flag if TLS enabled on source interface MITIG66 proposed None 1 threat
Tor security slider set to high MITIG67 optional 3 threats None
SQLAlchemy as an ORM MITIG68 implemented 2 threats None
Secure Temporary Wrapper to stream submissions encrypted on disk MITIG69 implemented 3 threats None
Debugging is disabled MITIG70 implemented 2 threats None
X-XSS-protection, CSP set to self MITIG71 implemented 4 threats None
Simple source interface application logic MITIG72 implemented 1 threat None
Ensure multiple concurrent sessions not possible MITIG73 proposed None 1 threat
Document all business logic flows / DFD for source interface MITIG74 proposed None 1 threat
Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed MITIG75 implemented 2 threats None
Limited attack surface exposed to ATHS and local network only MITIG76 implemented None None
Airgapped signing for release tags, public and controlled branches for development/release MITIG77 implemented 3 threats None
Use WAF MITIG78 proposed None 2 threats
X-FRAME-OPTIONS DENY HTTP header MITIG79 implemented 2 threats None
Verify all attributes are quoted as per http://flask.pocoo.org/docs/0.12/security/ MITIG80 proposed None 2 threats
Single, read-only public endpoint for Source Interface MITIG81 implemented None None
ATHS token for Journalist Interface and API MITIG82 implemented 2 threats None
Use of srm to delete files MITIG83 implemented None None
Use of separate USB drive for transfer of documents MITIG84 implemented None None
SecureDrop has default (but potentially customizable) text on source interface with post-Tor OPSEC information MITIG85 proposed None 4 threats
Source guide contains some OPSEC considerations MITIG86 implemented 5 threats 3 threats
Inform sources and journalists that no tool is perfect via "SecureDrop can contain bugs" text MITIG87 implemented 1 threat None
Journalist guide has detailed information about removing metadata and handling the malware threat MITIG88 proposed None 5 threats
Landing pages also describe in detail the safest ways to get Tor MITIG89 proposed None 2 threats
DNS over TLS MITIG90 proposed None 1 threat
Apt traffic over Tor MITIG91 proposed None 3 threats
Dependencies are kept to a minimum and only commonly used dependencies are used in SecureDrop MITIG92 implemented 1 threat None
Hashes of dependencies are stored in source control. MITIG93 implemented 1 threat None
Python wheels rebuilt from source tarballs at debian package build time. MITIG94 implemented 2 threats None
Diff and changelog review performed on Python dependencies when they are updated. MITIG95 proposed None 1 threat
Admin interface traffic goes over Tor MITIG96 implemented 2 threats None
Use authenticated version of NTP to harden against e.g. DNS attacks - tlsdate? research needed here MITIG97 proposed None 3 threats
Journalist guide mentions that metadata should be removed from documents MITIG98 implemented 2 threats None
Improve MAT in Tails MITIG99 Legacy (Tails/SVS) proposed None 1 threat
Firefox does not send DNS requests for onion addresses MITIG100 implemented 1 threat None
Chrome does not send DNS requests for onion addresses - is this still not the case? We should push this MITIG101 proposed None 1 threat
Brave does not send DNS requests for onion addresses - not the case yet but they're working on it MITIG102 proposed None 1 threat
Landing page deployment guide explains some security best practices for the webserver hosting the onion URL MITIG103 implemented 4 threats None
Alerts sent to admins and FPF when onion URLs change on landing pages (from monitoring via multiple Tor circuits and physical locations) MITIG104 proposed None 5 threats
securedrop.org directory explains sources should compare the onion URL in the directory with the one on the news org page MITIG105 implemented 2 threats 1 threat
Landing pages instruct users to compare onion URLs MITIG106 proposed None 3 threats
FPF staff try to seek out and add SecureDrops found in the wild to the directory MITIG107 proposed None 1 threat
Host latest TB binary on landing pages so no traffic goes to torproject.org MITIG108 proposed None 1 threat
securedrop.org moved to freedom.press/securedrop MITIG109 proposed None 1 threat
Move docs.securedrop.org to something like https://readthedocs.org/securedrop MITIG110 proposed None 1 threat
Encourage adoption of Tor within the news organization MITIG111 proposed None 1 threat
Honeypot/dummy SD servers MITIG112 proposed None 1 threat
Use a VPN before connecting to the Tor network MITIG113 proposed None 1 threat
SecureDrop hardware encouraged to be stored in a secure room / safe / environment MITIG114 Legacy (Tails/SVS) optional 2 threats None
Admin guide should speak clearly to physical security considerations MITIG115 proposed None 6 threats
Tamper-evident stickers/bags MITIG116 Legacy (Tails/SVS) proposed None 4 threats
Chassis intrusion detection MITIG117 Legacy (Tails/SVS) proposed None 1 threat
Buy retail hardware where possible MITIG118 proposed None 6 threats
Inspect physical hardware for implants (not really possible in many cases) MITIG119 proposed None 5 threats
Admin guide and trainings explain the risk of violating SD compartmentalization MITIG120 proposed 1 threat 1 threat
Source interface describes that the source should memorize the codename MITIG121 implemented 1 threat None
Source codenames stored hashed in the database MITIG122 implemented 2 threats None
2FA for source accounts MITIG123 proposed None 2 threats
Warning displayed when Tor2Web headers are present MITIG124 implemented 1 threat None
Source guide explains Tor2Web issues MITIG125 proposed None 1 threat
Tails disables sudo by default and needs to be rebooted to enable MITIG126 Legacy (Tails/SVS) implemented 2 threats None
2FA access for SecureDrop servers MITIG127 Legacy (Tails/SVS) proposed None 2 threats
Free software BIOS e.g. coreboot MITIG128 proposed 1 threat 2 threats
Validate integrity of BIOS MITIG129 Legacy (Tails/SVS) proposed 1 threat 1 threat
Dedicated admin workstation (laptop) stored in secure location MITIG130 Legacy (Tails/SVS) proposed None 1 threat
Tor onion creds stored in file, rarely displayed on screen (not really a mitigation... ) MITIG131 Legacy (Tails/SVS) implemented 1 threat None
Strongly discourage admins from modifying application code MITIG132 proposed None 1 threat
SOP for transferring admin keys and credentials MITIG133 Legacy (Tails/SVS) proposed None 1 threat
FDE on app/mon servers MITIG134 proposed None 4 threats
Physical monitoring, e.g. Haven MITIG135 proposed None 1 threat
Nighly reboot occurs to clear secrets stored in memory MITIG136 implemented 3 threats None
CAPTCHA for SecureDrop submissions MITIG137 proposed None 2 threats
SecureDrop submissions limited to 500 MB MITIG138 implemented 1 threat None
OSSEC alert sent when server almost full MITIG139 implemented 1 threat None
e2e encryption MITIG140 proposed None 4 threats
Admin guide explains incident response when admin tails key is tampered with / compromised MITIG141 Legacy (Tails/SVS) proposed None 2 threats
Do not write down passphrases MITIG142 Legacy (Tails/SVS) proposed None 2 threats
Admin guide explains incident response when journalist tails key is tampered with / compromised MITIG143 Legacy (Tails/SVS) proposed None 1 threat
Tails is an amnesiac OS MITIG144 Legacy (Tails/SVS) implemented 1 threat None
Journalists instructed to work in a secure room on SecureDrop. MITIG145 Legacy (Tails/SVS) implemented 1 threat None
Journalists/admins encouraged not to reuse credentials MITIG146 Legacy (Tails/SVS) proposed None 2 threats
Admin guide explains incident response when passphrase to online journalist workstation is compromised MITIG147 Legacy (Tails/SVS) proposed None 2 threats
OSSEC logs do not contain sensitive information. MITIG148 implemented 3 threats None
Users instructed not to move the SVS key off the SVS workstation MITIG149 implemented 2 threats None
Store SVS key on Yubikey MITIG150 Legacy (Tails/SVS) proposed None 2 threats
Admin guide explains incident response when submission key moved out of airgap or compromised MITIG151 Legacy (Tails/SVS) proposed None 4 threats
SecureDrop install guide explains that physical hardware like speakers, microphones, network devices should be removed from airgap MITIG152 Legacy (Tails/SVS) implemented 1 threat None
Journalist guide has cursory explanation of malware risks MITIG153 implemented 3 threats None
Transfer devices should be regularly sanitized - e.g. after each use. MITIG154 Legacy (Tails/SVS) proposed None 3 threats
Source guide explains what a source should do if they have malware (e.g. get a new computer or use Tails) - is source guide the best place for this? MITIG155 proposed None 2 threats
Sources instructed to use a non-monitored network (e.g. coffee shop) for Tor activity MITIG156 proposed None 3 threats
Website fingerprinting countermeasures MITIG157 proposed None 1 threat
Use VMs to sandbox documents as they are opened. MITIG158 proposed None 2 threats
Re-image SVS regularly. MITIG159 Legacy (Tails/SVS) proposed None 1 threat
Landing page subdomains discouraged MITIG160 implemented 1 threat None
Landing page scanner detects subdomains, warnings shown on directory MITIG161 proposed None 1 threat
Reproducible builds MITIG162 proposed None 1 threat
Dedicated secure build machine MITIG163 proposed None 1 threat
Wheels shipped in deb package (i.e. no pip install -r requirements.txt in prod) MITIG164 implemented 1 threat None
Nighly security update MITIG165 implemented 2 threats None
HTTPS on journalist interface MITIG166 proposed None 2 threats
apt performs GPG signature verification as long as it's not explicitly disabled MITIG167 implemented 4 threats None
Use v3 onion services MITIG168 implemented 1 threat 2 threats
Run source and journalist interface in separate VMs or containers MITIG169 proposed None 2 threats
Apache configured to expose source interface only via app-source-ths and journalist interface via app-journo-aths MITIG170 implemented 1 threat None
Journalist interface: Set-Cookie ^(.*)$ $;HttpOnly MITIG171 implemented 1 threat None
All session data deleted upon logout except language so the logout messages can be localized MITIG172 implemented 2 threats None
Server-side session management: session IDs invalidated upon logout MITIG173 proposed None 2 threats
Password change should invalidate current session MITIG174 proposed None 1 threat
Move SecureDrop to a compiled, memory-safe language like Rust to reduce likelihood of code injection/modification MITIG175 proposed None 1 threat
2FA required for SD maintainer GitHub accounts MITIG176 implemented 3 threats None
SecureDrop code is open source MITIG177 implemented 3 threats None
Discourage admins from installing additional code on the admin workstation MITIG178 Legacy (Tails/SVS) proposed None 1 threat
Document backup strategy for all SecureDrop components MITIG179 proposed None 1 threat
Provide stickers / color coding to help journalists enforce airgap MITIG180 Legacy (Tails/SVS) proposed None 1 threat
Journalist guide should explain airgap and describe how the drive should never be plugged into online workstation MITIG181 Legacy (Tails/SVS) proposed None 2 threats
Restrictive iptables rules on servers MITIG182 implemented 5 threats None
No logging on landing page MITIG183 implemented 1 threat None
Onion URL on every page of news organization website MITIG184 proposed None 1 threat
Cover traffic generated to SecureDrop landing pages via embed loaded on every page load MITIG185 proposed None 1 threat
GPG sign SecureDrop directory MITIG186 proposed None 1 threat
Use of CDNs discouraged for landing page (not really a reasonable ask, we use CDNs on securedrop.org) MITIG187 implemented 1 threat None
Detect use of CDN via landing page scanner (partially done) MITIG188 proposed None 1 threat
Journalist interface business logic is simple MITIG189 implemented 2 threats None
Document all business logic flows / DFD for journalist interface MITIG190 proposed None 1 threat
Support SecureDrop raid kill switch: Turn off / disable servers MITIG191 proposed None 2 threats
Benchmark / load test SecureDrop application - through Tor and without MITIG192 proposed None 1 threat
Extract and monitor Firewall logs MITIG193 proposed None 1 threat
Valid-Until for apt packages MITIG194 proposed 1 threat 1 threat
Write SecureDrop deployment guide in jurisdictions where Tor use is low MITIG195 proposed None 1 threat
Admins instructed to subscribe to RSS feed MITIG196 implemented 2 threats None
Send warnings from FPF for pfSense updates MITIG197 proposed None 2 threats
No source codename reset functionality MITIG198 implemented 1 threat None
Sources instructed to delete journalist replies after they read them MITIG199 implemented 1 threat None
Source interface: Has a single role MITIG200 implemented 1 threat None
Apache autoindex module disabled MITIG201 implemented 1 threat None
CSRF from Flask used MITIG202 implemented 2 threats None
Use different database users for Source, Journalist interfaces MITIG203 proposed None 2 threats
Source interface: Cache-Control nostore MITIG204 implemented 2 threats None
Sensitive data sent in POST requests MITIG205 implemented 2 threats None
Journalist logins are throttled MITIG206 implemented 1 threat None
Routes login protected by default on journalist interface MITIG207 implemented 1 threat None
Only 2 roles in journalist / admin interface MITIG208 implemented 1 threat None
Journalist interface is one big inbox (makes for simple logic) MITIG209 implemented 1 threat None
Restrict source information to certain journalist accounts MITIG210 proposed None 1 threat
Round timestamps of files MITIG211 proposed None 1 threat
No external URL redirection MITIG212 implemented 2 threats None
Untrusted uploaded data is directly encrypted and not executed MITIG213 implemented 2 threats None
HTTP headers do not expose version information MITIG214 implemented 2 threats None
Source interface: X-Content-Type-Options: nosniff MITIG215 implemented 1 threat None
Journalist interface: Sensitive information is not logged MITIG216 implemented 1 threat None
Journalist interface: X-Content-Type-Options: nosniff MITIG217 implemented 1 threat None
Admin guide explains incident response when 2FA seed is compromised MITIG218 Legacy (Tails/SVS) proposed None 1 threat
Admin guide explains security considerations of backup drive and the incident response if compromised MITIG219 proposed None 1 threat
Dummy submissions MITIG220 proposed None 1 threat
Source guide and interface should strongly warn about out of date TB MITIG221 proposed None 1 threat
SecureDrop uses as few apt packages as possible. MITIG222 implemented 1 threat None
Only packages in the security channel get updates MITIG223 implemented 1 threat None
SCIF for airgap workstation MITIG224 Legacy (Tails/SVS) proposed None 1 threat
Detailed OPSEC guide for journalists comms with respect to comms about source material within the news org MITIG225 proposed None 1 threat
Journalist guide contains some limited information about OPSEC with respect to source materials MITIG226 implemented 1 threat None
tag verified before building debian packages MITIG227 implemented 1 threat None
Install process instructs admins to validate sig on Tails ISO MITIG228 Legacy (Tails/SVS) implemented 1 threat None
Install process instructs admins to validate sig on Ubuntu ISO MITIG229 implemented 1 threat None
OSSEC heartbeat alert MITIG230 proposed None 1 threat
Mandate all signed commits MITIG231 proposed None 2 threats
Use hardware-backed token for SSH key auth to Github MITIG232 proposed None 2 threats
Shard SecureDrop release key MITIG233 proposed None 1 threat
Landing pages instruct sources to disable Javascript MITIG234 proposed None 1 threat
OSSEC emails are gpg encrypted MITIG235 implemented 2 threats None
OSSEC emails should be signed MITIG236 proposed 2 threats None
Use Signal for OSSEC alerts MITIG237 proposed None 3 threats
Minimal information exposed on Source Interface API endpoints MITIG238 implemented 1 threat None
app, mon server cannot access admin interface of hardware firewall MITIG239 implemented 1 threat None
Config managed by securedrop-client sdconfig CLI tool MITIG240 implemented 2 threats None
Prevent admins from undoing each other's site-specific changes MITIG241 proposed None 2 threats
Improve UX for admins / configuration management MITIG242 proposed None 2 threats
Scan / static analysis against Python dependency source code MITIG243 proposed None 1 threat
Switch to a personal inbox model MITIG244 proposed None 2 threats
Autoupdate all VMs MITIGQW1 implemented 1 threat None
Use long LTS OS MITIGQW2 implemented None None
grsecurity in all Debian templates MITIGQW3 implemented 7 threats 4 threats
Remove applications e.g. Tor Browser in Journalist VM (proxy VM) MITIGQW4 proposed None 3 threats
Firewall VM protects against network level attacks. MITIGQW5 implemented None None
AppArmor for Tor process MITIGQW6 implemented None None
Use HTTPS on journalist interface. MITIGQW7 proposed None None
Use hardware token to store submission key MITIGQW8 proposed None 3 threats
Use coreboot on workstation MITIGQW9 proposed 2 threats 2 threats
Use passphrase on submission key MITIGQW10 proposed None None
Careful validation in SDK MITIGQW11 proposed None 2 threats
Provide end-user documentation MITIGQW12 proposed None 1 threat
Default action for MIME handler in sd-app MITIGQW13 proposed None 1 threat
Files stored encrypted in sd-app VM - https://github.com/sqlcipher/sqlcipher MITIGQW14 proposed None None
Default Qubes-RPC deny policy MITIGQW15 implemented 2 threats 3 threats
Sanitize/validate GPG payload in sd-svs prior to sending to sd-gpg (https://github.com/freedomofpress/securedrop-client/issues/433) MITIGQW16 proposed None 2 threats
Escape content in the SecureDrop Client (https://github.com/freedomofpress/securedrop-client/issues/160) MITIGQW17 proposed None 1 threat
Use non-networked disposible VMs for opening all decrypted files. MITIGQW18 implemented 5 threats None
qrexec that proxies API requests and responses only to SecureDrop application server MITIGQW19 implemented 1 threat None
sd-client running in non networked VM MITIGQW20 implemented 3 threats None
sd-gpg running in non networked VM MITIGQW21 implemented None None
use of qubes split-gpg MITIGQW22 implemented None None
separate sd-whonix from sys-whonix so HidServAuth available only for securedrop VMs MITIGQW23 implemented None None
create individual templates for each role in workstation to minimize unnecessary package installs MITIGQW24 implemented 1 threat None
call `qvm-open-in-vm` instead of `xdg-open` in client in case of MIME type handler issue, so the files reliably open in dispVM MITIGQW25 implemented None None
shipping deb, rpm packages that are signed with airgap key for production release (beta and after) MITIGQW26 implemented None None
shipping template OS config via debs to ensure timely and reliable updates MITIGQW27 implemented None None
vulnerability alerts in CI for all securedrop workstation repo projects to alert of vulnerability in dependency MITIGQW28 implemented None None
sd-client stores data files in hidden directory to reduce risk of user error MITIGQW29 implemented None None
Move gzip parsing out of sd-app in case of gzip vuln MITIGQW30 proposed None None
Apparmor for securedrop client MITIGQW31 proposed None None
Force hard system shutdown instead of suspend/hibernate (https://github.com/freedomofpress/securedrop-workstation/issues/178) MITIGQW32 proposed None 1 threat
Hardening against exfiltration via separating display versus reply environments (https://github.com/freedomofpress/securedrop-workstation/issues/235) MITIGQW33 proposed None None
Wipe drives before exporting to minimize the risk of brinigng malware INTO the workstation environment MITIGQW34 proposed None None
Disabling hyperthreading (done by Qubes) MITIGQW35 implemented 2 threats None
sd-proxy has server hardcoded MITIGQW36 proposed 2 threats None
Limiting size of journalist replies. MITIGQW37 proposed None 1 threat
Logging exfiltration attempts. MITIGQW38 proposed None 1 threat
Throttling. MITIGQW39 proposed None 1 threat
Don't use intel CPUs MITIGQW40 proposed 1 threat None
Sign replies with submission key, verify signature server-side MITIGQW41 proposed None 3 threats
Centralized logging MITIGQW42 proposed None None
Use tags to prevent file VMs from running concurrently with decryption actions: https://github.com/QubesOS/qubes-issues/issues/2866 MITIGQW43 proposed None None
Latest microcode applied in dom0 via: https://github.com/QubesOS/qubes-intel-microcode MITIGQW44 proposed None None
Thumbnails off by default in Files application such that they're not parsed MITIGQW45 implemented None None
API Tokens are revoked upon logout MITIGQW47 proposed None None
Qubes - full disk encryption MITIGQW48 implemented 1 threat None
Execute bit is dropped during server side archive/clientside unarchive process MITIGQW49 implemented 1 threat None
Use safeboot or qubes anti-evil-maid for measured boot (https://github.com/freedomofpress/securedrop-workstation/issues/602) MITIGQW50 proposed 2 threats None
Two man rule for admin changes MITIGQW51 proposed None 1 threat
Hide identity of admin to prevent targeted attacks MITIGQW52 proposed None 1 threat
TLS layer between sd-app and server MITIGQW53 proposed None 1 threat