Scenario: Physical and host layer

Defined in model.py:639

Host/OS and physical room surface.

11 open threats, highest risk 9 high · 23 threats in all · 3 data flows · 4 affected components

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Sequence Diagram

sequenceDiagram
    participant SecureDrop_Application as SecureDrop Application
    link SecureDrop_Application: Component @ component_SecureDrop_Application.html
    participant Application_Server__host_ as Application Server (host)
    link Application_Server__host_: Component @ component_Application_Server__host_.html
    participant OSSEC_server as OSSEC server
    link OSSEC_server: Component @ component_OSSEC_server.html
    participant Monitoring_Server__host_ as Monitoring Server (host)
    link Monitoring_Server__host_: Component @ component_Monitoring_Server__host_.html
    participant SecureDrop_server_room as SecureDrop server room
    link SecureDrop_server_room: Component @ component_SecureDrop_server_room.html

    SecureDrop_Application->>Application_Server__host_: 1. Services on app host
    OSSEC_server->>Monitoring_Server__host_: 2. Services on mon host
    Application_Server__host_->>SecureDrop_server_room: 3. Hosts in server room

Show data flows

ID	Name	Source	Sink	Type
1	Services on app host	SecureDrop Application	Application Server (host)	Request
2	Services on mon host	OSSEC server	Monitoring Server (host)	Request
3	Hosts in server room	Application Server (host)	SecureDrop server room	Request

Applicable threats

Threat	Component	Status	Risk	After mitigations	Mitigations
Configuration vulnerability in Source interface THREAT5	SecureDrop Application	partially mitigated	9 high	9 high	Config managed by securedrop-client sdconfig CLI tool
SecureDrop server identification THREAT93	Application Server (host)	out of scope	8 high	8 high
SecureDrop server identification THREAT93	Monitoring Server (host)	out of scope	8 high	8 high
Monitor server configuration error THREAT65	Monitoring Server (host)	partially mitigated	9 high	6 medium	Use of Ansible for configuration management for servers
Application server configuration error THREAT169	SecureDrop Application	partially mitigated	9 high	6 medium	Use of Ansible for configuration management for servers
Configuration vulnerability in Journalist interface THREAT9	SecureDrop Application	mitigated	6 medium	6 medium	Config managed by securedrop-client sdconfig CLI tool
App server supply chain attack THREAT99	Application Server (host)	inform	6 medium	6 medium
App server (physical) tampering THREAT107	Application Server (host)	partially mitigated	6 medium	6 medium	Swap disabled on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software; Nighly reboot occurs to clear secrets stored in memory
Firmware exploits/ME exploits for application server THREAT110	Application Server (host)	accepted	6 medium	6 medium
Monitor server is tampered THREAT124	Monitoring Server (host)	partially mitigated	6 medium	6 medium	OSSEC logs do not contain sensitive information.
Monitor server supply chain attack THREAT125	Monitoring Server (host)	inform	6 medium	6 medium
HTTP security configuration vulnerability in Source interface THREAT23	SecureDrop Application	mitigated	4 medium	4 medium	Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Source interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self
HTTP security configuration vulnerability in Journalist interface THREAT27	SecureDrop Application	mitigated	4 medium	4 medium	Only GET, POST, HEAD, (DELETE for JI) HTTP methods allowed; HTTP headers do not expose version information; Journalist interface: X-Content-Type-Options: nosniff; X-XSS-protection, CSP set to self
Monitor server is compromised THREAT66	Monitoring Server (host)	accepted	4 medium	4 medium	ATHS token for connecting to servers via SSH; Use of external dedicated hardware firewall; Restrictive iptables rules on servers; Nighly security update; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
App server seized THREAT147	Application Server (host)	partially mitigated	4 medium	4 medium	Secure Temporary Wrapper to stream submissions encrypted on disk; Use of airgapped SVS key; Nighly reboot occurs to clear secrets stored in memory; Swap disabled on servers
Monitor server is seized THREAT152	Monitoring Server (host)	partially mitigated	4 medium	4 medium	OSSEC logs do not contain sensitive information.
Firewall rule misconfiguration on application server THREAT31	Application Server (host)	partially mitigated	9 high	3 low	Use of Ansible for configuration management for servers; Use of external dedicated hardware firewall
Unknown vulnerabilities in the Linux Kernel THREAT40	Application Server (host)	partially mitigated	6 medium	3 low	Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Unknown vulnerabilities in the Linux Kernel THREAT40	Monitoring Server (host)	partially mitigated	6 medium	3 low	Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Known vulnerabilities in the Linux kernel or packages used by app/mon servers THREAT41	Application Server (host)	mitigated	6 medium	3 low	Automatic updates on servers; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Known vulnerabilities in the Linux kernel or packages used by app/mon servers THREAT41	Monitoring Server (host)	mitigated	6 medium	3 low	Automatic updates on servers; Use of grsecurity-hardened kernels on servers; AppArmor on Tor; AppArmor on Apache; Use of OSSEC monitoring software
Ubuntu ISO malicious THREAT43	Application Server (host)	inform	6 medium	3 low	Install process instructs admins to validate sig on Ubuntu ISO
Ubuntu ISO malicious THREAT43	Monitoring Server (host)	inform	6 medium	3 low	Install process instructs admins to validate sig on Ubuntu ISO
No mitigation or revocation for compromised key THREAT172	Application Server (host)	partially mitigated	6 medium	3 low	Use of airgapped SVS key; Persistent storage FDE for SVS; Users instructed not to move the SVS key off the SVS workstation
Monitor server is down THREAT158	Monitoring Server (host)	inform	3 low	3 low
Attacker exploits postfix THREAT67	Monitoring Server (host)	partially mitigated	4 medium	2 low	Use of grsecurity-hardened kernels on servers
Physical access to server room THREAT84	SecureDrop server room	out of scope	Unknown	Unknown

Back to Summary