Scenario: Workstation lifecycle and backups Legacy (Tails/SVS)

Defined in model.py:623

Physical/lifecycle threat surface of the admin and journalist Tails devices.

14 open threats, highest risk 9 high · 34 threats in all · 3 data flows · 3 affected components

Data Flow Diagram

Sequence Diagram

Show data flows
ID Name Source Sink Type
1 Admin operates workstation Administrator Admin Workstation (device) Request
2 Journalist operates workstation Journalist Journalist Workstation (device) Request
3 Back up secrets Admin Workstation (device) Backup / recovery media Request

Applicable threats

Threat Component Status Risk After mitigations Mitigations
Failure to sanitize documents THREAT87 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 9 high 9 high Journalist guide mentions that metadata should be removed from documents
Admin laptop seized THREAT94 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Admin laptop tampered THREAT95 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium SecureDrop hardware encouraged to be stored in a secure room / safe / environment
Admin laptop supply chain attack THREAT96 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Admin Tails USB stick tampered THREAT97 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Admin violates compartmentalisation procedure THREAT98 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) inform 6 medium 6 medium
Admin laptop seized while powered on THREAT100 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Tails disables sudo by default and needs to be rebooted to enable
Admin Tails Persistent Volume passphrase compromised THREAT101 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) inform 6 medium 6 medium
Admin Tails workstation firmware compromised THREAT102 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Admin activity compromised physical surveillance (e.g.: video camera) THREAT103 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium SSH password auth disabled, requires key; Tor onion creds stored in file, rarely displayed on screen (not really a mitigation... )
Admin key sent by (smail) mail and intercepted THREAT106 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Persistent FDE Storage of Admin Tails Key
Journalist Tails workstation seized THREAT112 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Persistent storage FDE for Journalist Workstation
Journalist Tails workstation seized while powered on THREAT113 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Tails disables sudo by default and needs to be rebooted to enable
Journalist Tails workstation tampered THREAT114 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Journalist Tails workstation supply chain attack THREAT115 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) inform 6 medium 6 medium
Journalist workstation Tails key tampered THREAT116 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) accepted 6 medium 6 medium
Journalist Tails workstation firmware compromised THREAT117 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Free software BIOS e.g. coreboot; Validate integrity of BIOS
Journalist Tails workstation compromised by malware THREAT118 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Tails is an amnesiac OS; Use of airgapped SVS key
Journalist activity compromised physical surveillance (e.g.: video camera) THREAT119 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) inform 6 medium 6 medium Journalists instructed to work in a secure room on SecureDrop.
Failure to segregate Securedrop environment from corporate environment or personal environment THREAT120 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Use of airgapped SVS key; Passphrases for journalists and admins are generated to be 7 word diceware
Failure to segregate Securedrop environment from corporate environment or personal environment THREAT120 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 6 medium 6 medium Use of airgapped SVS key; Passphrases for journalists and admins are generated to be 7 word diceware
Journalist workstation Tails Persistent Volume passphrase compromised THREAT121 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) inform 6 medium 6 medium
Admin two-factor authentication device is lost or compromised THREAT1 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 4 medium 4 medium Passphrases for journalists and admins are generated to be 7 word diceware
Admin workstation backup stick is compromised THREAT2 Backup / recovery media accepted 4 medium 4 medium Persistent storage FDE for Admin Workstation
Additional software installed on Admin Workstation THREAT140 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) inform 4 medium 4 medium
Backups THREAT141 Backup / recovery media inform 4 medium 4 medium
USB transfer device malware compromises Journalist Workstation THREAT143 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) accepted 4 medium 4 medium
Admin Tails USB stick lost/seized THREAT144 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 4 medium 4 medium Persistent FDE Storage of Admin Tails Key
Compromise admin's corporate (or personal) devices or accounts THREAT145 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) partially mitigated 4 medium 4 medium Use of external dedicated hardware firewall
Journalist workstation Tails Key seized THREAT151 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 4 medium 4 medium Persistent storage FDE for Journalist Workstation
Journalist two-factor authentication device is lost or compromised THREAT157 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) accepted 4 medium 4 medium
Tails ISO malicious THREAT42 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) inform 6 medium 3 low Install process instructs admins to validate sig on Tails ISO
Tails ISO malicious THREAT42 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) inform 6 medium 3 low Install process instructs admins to validate sig on Tails ISO
Admin SSH Key is compromised THREAT3 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) accepted 3 low 3 low HidServAuth token on SSH
Admin's network being monitored THREAT4 Legacy (Tails/SVS) Admin Workstation (device) Legacy (Tails/SVS) mitigated 6 medium 2 low HidServAuth token on SSH
Journalist network being monitored THREAT161 Legacy (Tails/SVS) Journalist Workstation (device) Legacy (Tails/SVS) partially mitigated 2 low 2 low Journalist interface only available as a Tor onion service

Back to Summary