Scenario: Admin access

Defined in model.py:565

Admin reaches both servers over SSH on authenticated Tor onions.

1 open threat, highest risk 6 medium · 6 threats in all · 3 data flows · 2 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_SSH_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server SSH";
            URL = "component_App_Server_SSH.html";
            tooltip = "App Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_SSH_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nSSH";
            URL = "component_Monitor_Server_SSH.html";
            tooltip = "Monitor Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. SSH over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_App_Server_SSH_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Admin App Server";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Monitor_Server_SSH_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Admin Monitor\nServer";    ]
}

Sequence Diagram

sequenceDiagram
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant App_Server_SSH as App Server SSH
    link App_Server_SSH: Component @ component_App_Server_SSH.html
    participant Monitor_Server_SSH as Monitor Server SSH
    link Monitor_Server_SSH: Component @ component_Monitor_Server_SSH.html

    Administrator->>Dedicated_Hardware_Firewall: 1. SSH over Tor
    Dedicated_Hardware_Firewall->>App_Server_SSH: 2. Admin App Server
    Dedicated_Hardware_Firewall->>Monitor_Server_SSH: 3. Admin Monitor Server

Show data flows

ID	Name	Source	Sink	Type
1	SSH over Tor	Administrator	Dedicated Hardware Firewall	Request
2	Admin App Server	Dedicated Hardware Firewall	App Server SSH	Request
3	Admin Monitor Server	Dedicated Hardware Firewall	Monitor Server SSH	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
SSH configuration error on application server THREAT168	App Server SSH	partially mitigated	9 high	6 medium	Use of Ansible for configuration management for servers
Firewall not up to date THREAT47	Dedicated Hardware Firewall	inform	8 high	4 medium	Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed
Firewall logs are not monitored THREAT149	Dedicated Hardware Firewall	inform	4 medium	4 medium
Hardware Firewall Supply chain attack THREAT150	Dedicated Hardware Firewall	accepted	4 medium	4 medium	Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service; Admin interface traffic goes over Tor; apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers
Vulnerabilities/Compromise of Hardware Firewall THREAT48	Dedicated Hardware Firewall	mitigated	4 medium	2 low	apt performs GPG signature verification as long as it's not explicitly disabled; Restrictive iptables rules on servers; Admins instructed to subscribe to RSS feed; app, mon server cannot access admin interface of hardware firewall; Source interface only available as a Tor onion service; Journalist interface only available as a Tor onion service
Hardware Firewall Misconfiguration THREAT49	Dedicated Hardware Firewall	mitigated	4 medium	2 low	Restrictive iptables rules on servers

Back to Summary