Scenario: Transfer & decrypt Legacy (Tails/SVS)

Defined in model.py:532

Encrypted submission is carried to the SVS, decrypted and sanitized.

5 open threats, highest risk 8 high · 20 threats in all · 4 data flows · 2 affected components

Data Flow Diagram

Sequence Diagram

Show data flows
ID Name Source Sink Type
1 Copy to transfer device Journalist Transfer Device Request
2 Carry to air-gap Transfer Device Secure Viewing Station Request
3 Decrypt offline Secure Viewing Station Secure Viewing Station Request
4 Sanitize Secure Viewing Station Secure Viewing Station Request

Applicable threats

Threat Component Status Risk After mitigations Mitigations
Unsanitized decrypted files are transfered to journalist workstation without prior sanitization THREAT138 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) partially mitigated 8 high 8 high Persistent FDE Storage of Transfer Device; Persistent storage FDE for Journalist Workstation
Airgap broken by documents being decrypted on transfer device THREAT165 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) inform 8 high 8 high
Airgapped SVS malware THREAT72 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 6 medium 6 medium Journalist guide has cursory explanation of malware risks
Submission key is moved to a non-airgapped machine - journalist/admin workstation THREAT126 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 6 medium 6 medium Users instructed not to move the SVS key off the SVS workstation
Airgapped SVS laptop seized while powered on THREAT127 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) partially mitigated 6 medium 6 medium
Exfiltration of SVS data through malicious documents THREAT128 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Use of airgapped SVS key; Journalist guide has cursory explanation of malware risks
USB transfer device malware compromises SVS THREAT129 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) mitigated 6 medium 6 medium Use of airgapped SVS key; SecureDrop install guide explains that physical hardware like speakers, microphones, network devices should be removed from airgap
Airgapped SVS laptop seized THREAT130 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) accepted 6 medium 6 medium
Airgapped SVS supply chain attack THREAT132 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 6 medium 6 medium
Airgapped SVS Tails key seized THREAT133 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Persistent storage FDE for SVS
Airgapped SVS Tails Persistent Volume passphrase compromised THREAT134 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 6 medium 6 medium
Malware on transfer device breaks SVS airgap THREAT139 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) inform 6 medium 6 medium
Transfer device seized/stolen/lost THREAT81 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) inform 4 medium 4 medium Persistent FDE Storage of Transfer Device
SVS drive plugged into/mounted on non-airgapped machine. THREAT142 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 4 medium 4 medium
Airgapped SVS Tails key tampered THREAT153 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) accepted 4 medium 4 medium Persistent storage FDE for SVS
SVS activity compromised physical surveillance (e.g.: video camera) THREAT154 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) partially mitigated 4 medium 4 medium SecureDrop hardware encouraged to be stored in a secure room / safe / environment
Tails ISO malicious THREAT42 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) inform 6 medium 3 low Install process instructs admins to validate sig on Tails ISO
Side-channel attacks on Airgapped SVS THREAT160 Legacy (Tails/SVS) Secure Viewing Station Legacy (Tails/SVS) accepted 3 low 3 low
Transfer device passphrase compromised THREAT162 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) inform 6 medium 2 low Persistent FDE Storage of Transfer Device
Transfer device tampered THREAT46 Legacy (Tails/SVS) Transfer Device Legacy (Tails/SVS) inform 1 low 1 low Persistent FDE Storage of Transfer Device

Back to Summary