Scenarios

Source submission

Anonymous source submits over Tor; app encrypts and stores it.

5 open threats, highest risk 9 high · 30 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Submit over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Source\nInterface";    ]
    component_Source_Interface_Application_Server -> component_SecureDrop_Application_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hand to app";    ]
    component_SecureDrop_Application_Application_Server -> component_Encrypted_submission_store_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Encrypt & store";    ]
    component_SecureDrop_Application_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Record metadata";    ]
}

Sequence Diagram

sequenceDiagram
    participant Source as Source
    link Source: Component @ component_Source.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Source_Interface as Source Interface
    link Source_Interface: Component @ component_Source_Interface.html
    participant SecureDrop_Application as SecureDrop Application
    link SecureDrop_Application: Component @ component_SecureDrop_Application.html
    participant Encrypted_submission_store as Encrypted submission store
    link Encrypted_submission_store: Component @ component_Encrypted_submission_store.html
    participant Metadata_DB as Metadata DB
    link Metadata_DB: Component @ component_Metadata_DB.html

    Source->>Dedicated_Hardware_Firewall: 1. Submit over Tor
    Dedicated_Hardware_Firewall->>Source_Interface: 2. Reach Source Interface
    Source_Interface->>SecureDrop_Application: 3. Hand to app
    SecureDrop_Application->>Encrypted_submission_store: 4. Encrypt & store
    SecureDrop_Application->>Metadata_DB: 5. Record metadata

Journalist triage

Authenticated journalist browses and downloads encrypted submissions.

4 open threats, highest risk 6 medium · 20 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Authenticate over\nTor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Journalist\nInterface";    ]
    component_Journalist_Interface_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. List sources";    ]
    component_Encrypted_submission_store_Application_Server -> actor_Journalist_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Download\nencrypted";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Journalist_Interface as Journalist Interface
    link Journalist_Interface: Component @ component_Journalist_Interface.html
    participant Metadata_DB as Metadata DB
    link Metadata_DB: Component @ component_Metadata_DB.html
    participant Encrypted_submission_store as Encrypted submission store
    link Encrypted_submission_store: Component @ component_Encrypted_submission_store.html

    Journalist->>Dedicated_Hardware_Firewall: 1. Authenticate over Tor
    Dedicated_Hardware_Firewall->>Journalist_Interface: 2. Reach Journalist Interface
    Journalist_Interface->>Metadata_DB: 3. List sources
    Encrypted_submission_store->>Journalist: 4. Download encrypted

Transfer & decrypt Legacy (Tails/SVS)

Encrypted submission is carried to the SVS, decrypted and sanitized.

5 open threats, highest risk 8 high · 20 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    component_Transfer_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Transfer Device";
        URL = "component_Transfer_Device.html";
        tooltip = "Transfer Device (Legacy (Tails/SVS))";
        margin = 0.02;
        style = "dashed";
        class = "tagged";
    ]

    actor_Journalist_ -> component_Transfer_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Copy to transfer\ndevice";    ]
    component_Transfer_Device_ -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Carry to air-gap";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Decrypt offline";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Secure_Viewing_Station_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Sanitize";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Transfer_Device as Transfer Device
    link Transfer_Device: Component @ component_Transfer_Device.html
    participant Secure_Viewing_Station as Secure Viewing Station
    link Secure_Viewing_Station: Component @ component_Secure_Viewing_Station.html

    Journalist->>Transfer_Device: 1. Copy to transfer device
    Transfer_Device->>Secure_Viewing_Station: 2. Carry to air-gap
    Secure_Viewing_Station->>Secure_Viewing_Station: 3. Decrypt offline
    Secure_Viewing_Station->>Secure_Viewing_Station: 4. Sanitize

Publish & export Legacy (Tails/SVS)

Sanitized output leaves the air-gap to the publishing area or print.

4 open threats, highest risk 6 medium · 13 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Airgapped_Viewing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Airgapped Viewing Area</i>>;
        ]

        component_Offline_Printer_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Offline Printer";
            URL = "component_Offline_Printer.html";
            tooltip = "Offline Printer (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

        component_Secure_Viewing_Station_Airgapped_Viewing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Secure Viewing\nStation";
            URL = "component_Secure_Viewing_Station.html";
            tooltip = "Secure Viewing Station (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    subgraph cluster_boundary_Publishing_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Publishing Area</i>>;
        ]

        component_Sanitized_submission_Publishing_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Sanitized\nsubmission";
            URL = "component_Sanitized_submission.html";
            tooltip = "Sanitized submission";
            margin = 0.02;
        ]

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Export sanitized";    ]
    component_Export_Device_ -> component_Sanitized_submission_Publishing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. To publishing\narea";    ]
    component_Secure_Viewing_Station_Airgapped_Viewing_Area -> component_Offline_Printer_Airgapped_Viewing_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Print";    ]
}

Sequence Diagram

sequenceDiagram
    participant Secure_Viewing_Station as Secure Viewing Station
    link Secure_Viewing_Station: Component @ component_Secure_Viewing_Station.html
    participant Export_Device as Export Device
    link Export_Device: Component @ component_Export_Device.html
    participant Sanitized_submission as Sanitized submission
    link Sanitized_submission: Component @ component_Sanitized_submission.html
    participant Offline_Printer as Offline Printer
    link Offline_Printer: Component @ component_Offline_Printer.html

    Secure_Viewing_Station->>Export_Device: 1. Export sanitized
    Export_Device->>Sanitized_submission: 2. To publishing area
    Secure_Viewing_Station->>Offline_Printer: 3. Print

Admin access

Admin reaches both servers over SSH on authenticated Tor onions.

1 open threat, highest risk 6 medium · 6 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_SSH_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server SSH";
            URL = "component_App_Server_SSH.html";
            tooltip = "App Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_SSH_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nSSH";
            URL = "component_Monitor_Server_SSH.html";
            tooltip = "Monitor Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. SSH over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_App_Server_SSH_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Admin App Server";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Monitor_Server_SSH_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Admin Monitor\nServer";    ]
}

Sequence Diagram

sequenceDiagram
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant App_Server_SSH as App Server SSH
    link App_Server_SSH: Component @ component_App_Server_SSH.html
    participant Monitor_Server_SSH as Monitor Server SSH
    link Monitor_Server_SSH: Component @ component_Monitor_Server_SSH.html

    Administrator->>Dedicated_Hardware_Firewall: 1. SSH over Tor
    Dedicated_Hardware_Firewall->>App_Server_SSH: 2. Admin App Server
    Dedicated_Hardware_Firewall->>Monitor_Server_SSH: 3. Admin Monitor Server

Monitoring & alerting

OSSEC watches the app server; encrypted alerts are mailed to admins.

4 open threats, highest risk 6 medium · 4 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_OSSEC_client_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC client";
            URL = "component_OSSEC_client.html";
            tooltip = "OSSEC client";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

        component_Postfix_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Postfix";
            URL = "component_Postfix.html";
            tooltip = "Postfix";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_OSSEC_client_Application_Server -> component_OSSEC_server_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Ship events";    ]
    component_OSSEC_server_Monitoring_Server -> component_Postfix_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Raise alert";    ]
    component_Postfix_Monitoring_Server -> component_SMTP_relay_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Relay mail";    ]
    component_SMTP_relay_External_Services -> actor_Administrator_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Deliver to admin";    ]
}

Sequence Diagram

sequenceDiagram
    participant OSSEC_client as OSSEC client
    link OSSEC_client: Component @ component_OSSEC_client.html
    participant OSSEC_server as OSSEC server
    link OSSEC_server: Component @ component_OSSEC_server.html
    participant Postfix as Postfix
    link Postfix: Component @ component_Postfix.html
    participant SMTP_relay as SMTP relay
    link SMTP_relay: Component @ component_SMTP_relay.html
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html

    OSSEC_client->>OSSEC_server: 1. Ship events
    OSSEC_server->>Postfix: 2. Raise alert
    Postfix->>SMTP_relay: 3. Relay mail
    SMTP_relay->>Administrator: 4. Deliver to admin

Updates, time & DNS

App server reaches package/time/DNS services via the monitor gateway.

3 open threats, highest risk 9 high · 13 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_DNS_resolver_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DNS resolver";
            URL = "component_DNS_resolver.html";
            tooltip = "DNS resolver";
            margin = 0.02;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_NTP_server_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "NTP server";
            URL = "component_NTP_server.html";
            tooltip = "NTP server";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nAPT/NTP/DNS";
            URL = "component_Monitor_Server_APT_NTP_DNS.html";
            tooltip = "Monitor Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    component_App_Server_APT_NTP_DNS_Application_Server -> component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Proxy via monitor";    ]
    component_Monitor_Server_APT_NTP_DNS_Monitoring_Server -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Egress via\nfirewall";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Ubuntu_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Ubuntu apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "4. FPF apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_NTP_server_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "5. NTP";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_DNS_resolver_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "6. DNS";    ]
}

Sequence Diagram

sequenceDiagram
    participant App_Server_APT_NTP_DNS as App Server APT/NTP/DNS
    link App_Server_APT_NTP_DNS: Component @ component_App_Server_APT_NTP_DNS.html
    participant Monitor_Server_APT_NTP_DNS as Monitor Server APT/NTP/DNS
    link Monitor_Server_APT_NTP_DNS: Component @ component_Monitor_Server_APT_NTP_DNS.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html
    participant Ubuntu_apt_repository as Ubuntu apt repository
    link Ubuntu_apt_repository: Component @ component_Ubuntu_apt_repository.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html
    participant NTP_server as NTP server
    link NTP_server: Component @ component_NTP_server.html
    participant DNS_resolver as DNS resolver
    link DNS_resolver: Component @ component_DNS_resolver.html

    App_Server_APT_NTP_DNS->>Monitor_Server_APT_NTP_DNS: 1. Proxy via monitor
    Monitor_Server_APT_NTP_DNS->>Dedicated_Hardware_Firewall: 2. Egress via firewall
    Dedicated_Hardware_Firewall->>Ubuntu_apt_repository: 3. Ubuntu apt
    Dedicated_Hardware_Firewall->>FPF_apt_repository: 4. FPF apt
    Dedicated_Hardware_Firewall->>NTP_server: 5. NTP
    Dedicated_Hardware_Firewall->>DNS_resolver: 6. DNS

Source discovery and OPSEC

How a source finds the instance and the pre-submission OPSEC surface.

10 open threats, highest risk 9 high · 34 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Sequence Diagram

sequenceDiagram
    participant Source as Source
    link Source: Component @ component_Source.html
    participant Source_environment as Source environment
    link Source_environment: Component @ component_Source_environment.html
    participant SecureDrop_org_directory as SecureDrop.org directory
    link SecureDrop_org_directory: Component @ component_SecureDrop_org_directory.html
    participant Landing_page as Landing page
    link Landing_page: Component @ component_Landing_page.html
    participant Source_Tor_Browser as Source Tor Browser
    link Source_Tor_Browser: Component @ component_Source_Tor_Browser.html
    participant Dedicated_Hardware_Firewall as Dedicated Hardware Firewall
    link Dedicated_Hardware_Firewall: Component @ component_Dedicated_Hardware_Firewall.html

    Source->>Source_environment: 1. Research / browse
    Source_environment->>SecureDrop_org_directory: 2. Check directory
    Source_environment->>Landing_page: 3. Visit landing page
    Source->>Source_Tor_Browser: 4. Open Tor Browser
    Source_Tor_Browser->>Dedicated_Hardware_Firewall: 5. Connect to onion

Supply chain and dependencies

Source code is built, signed, published, and installed on the servers.

6 open threats, highest risk 9 high · 36 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_SecureDrop_release___package_build_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nrelease &\npackage build";
            URL = "component_SecureDrop_release___package_build.html";
            tooltip = "SecureDrop release & package build";
            margin = 0.02;
        ]

        component_SecureDrop_source_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nsource\nrepository";
            URL = "component_SecureDrop_source_repository.html";
            tooltip = "SecureDrop source repository";
            margin = 0.02;
        ]

        component_Tor_software_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Tor software";
            URL = "component_Tor_software.html";
            tooltip = "Tor software";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    component_SecureDrop_source_repository_External_Services -> component_SecureDrop_release___package_build_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "1. Build from source";    ]
    component_SecureDrop_release___package_build_External_Services -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Publish packages";    ]
    component_FPF_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Install / update";    ]
    component_Ubuntu_apt_repository_External_Services -> component_App_Server_APT_NTP_DNS_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Ubuntu\ndependencies";    ]
    component_Tor_software_External_Services -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Tor dependency";    ]
}

Sequence Diagram

sequenceDiagram
    participant SecureDrop_source_repository as SecureDrop source repository
    link SecureDrop_source_repository: Component @ component_SecureDrop_source_repository.html
    participant SecureDrop_release___package_build as SecureDrop release & package build
    link SecureDrop_release___package_build: Component @ component_SecureDrop_release___package_build.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html
    participant App_Server_APT_NTP_DNS as App Server APT/NTP/DNS
    link App_Server_APT_NTP_DNS: Component @ component_App_Server_APT_NTP_DNS.html
    participant Ubuntu_apt_repository as Ubuntu apt repository
    link Ubuntu_apt_repository: Component @ component_Ubuntu_apt_repository.html
    participant Tor_software as Tor software
    link Tor_software: Component @ component_Tor_software.html
    participant Source_Interface as Source Interface
    link Source_Interface: Component @ component_Source_Interface.html

    SecureDrop_source_repository->>SecureDrop_release___package_build: 1. Build from source
    SecureDrop_release___package_build->>FPF_apt_repository: 2. Publish packages
    FPF_apt_repository->>App_Server_APT_NTP_DNS: 3. Install / update
    Ubuntu_apt_repository->>App_Server_APT_NTP_DNS: 4. Ubuntu dependencies
    Tor_software->>Source_Interface: 5. Tor dependency

Workstation lifecycle and backups Legacy (Tails/SVS)

Physical/lifecycle threat surface of the admin and journalist Tails devices.

14 open threats, highest risk 9 high · 34 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Admin_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Admin Workstation (Tails)</i>>;
        ]

        component_Admin_Workstation__device__Admin_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Admin\nWorkstation\n(device)";
            URL = "component_Admin_Workstation__device_.html";
            tooltip = "Admin Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    subgraph cluster_boundary_Journalist_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Journalist Workstation (Tails)</i>>;
        ]

        component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nWorkstation\n(device)";
            URL = "component_Journalist_Workstation__device_.html";
            tooltip = "Journalist Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_Backup___recovery_media_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Backup /\nrecovery media";
        URL = "component_Backup___recovery_media.html";
        tooltip = "Backup / recovery media";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Admin_Workstation__device__Admin_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Admin operates\nworkstation";    ]
    actor_Journalist_ -> component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist\noperates workstation";    ]
    component_Admin_Workstation__device__Admin_Workstation__Tails_ -> component_Backup___recovery_media_ [        color = black;        fontcolor = black;        dir = forward;        label = "3. Back up secrets";    ]
}

Sequence Diagram

sequenceDiagram
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html
    participant Admin_Workstation__device_ as Admin Workstation (device)
    link Admin_Workstation__device_: Component @ component_Admin_Workstation__device_.html
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Journalist_Workstation__device_ as Journalist Workstation (device)
    link Journalist_Workstation__device_: Component @ component_Journalist_Workstation__device_.html
    participant Backup___recovery_media as Backup / recovery media
    link Backup___recovery_media: Component @ component_Backup___recovery_media.html

    Administrator->>Admin_Workstation__device_: 1. Admin operates workstation
    Journalist->>Journalist_Workstation__device_: 2. Journalist operates workstation
    Admin_Workstation__device_->>Backup___recovery_media: 3. Back up secrets

Physical and host layer

Host/OS and physical room surface.

11 open threats, highest risk 9 high · 23 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Sequence Diagram

sequenceDiagram
    participant SecureDrop_Application as SecureDrop Application
    link SecureDrop_Application: Component @ component_SecureDrop_Application.html
    participant Application_Server__host_ as Application Server (host)
    link Application_Server__host_: Component @ component_Application_Server__host_.html
    participant OSSEC_server as OSSEC server
    link OSSEC_server: Component @ component_OSSEC_server.html
    participant Monitoring_Server__host_ as Monitoring Server (host)
    link Monitoring_Server__host_: Component @ component_Monitoring_Server__host_.html
    participant SecureDrop_server_room as SecureDrop server room
    link SecureDrop_server_room: Component @ component_SecureDrop_server_room.html

    SecureDrop_Application->>Application_Server__host_: 1. Services on app host
    OSSEC_server->>Monitoring_Server__host_: 2. Services on mon host
    Application_Server__host_->>SecureDrop_server_room: 3. Hosts in server room

Corporate and legal zone

News-org corporate/personal environment and legal exposure (largely out of scope).

4 open threats, highest risk 2 low · 8 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_News_Organization {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>News Organization</i>>;
        ]

        component_Journalist_Corporate_Workstation_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nCorporate\nWorkstation";
            URL = "component_Journalist_Corporate_Workstation.html";
            tooltip = "Journalist Corporate Workstation";
            margin = 0.02;
        ]

        component_News_Organization___Legal_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "News\nOrganization /\nLegal";
            URL = "component_News_Organization___Legal.html";
            tooltip = "News Organization / Legal";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "1. Journalist uses\ncorporate device";    ]
    component_SMTP_relay_External_Services -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "2. Alerts to\ncorporate mail";    ]
    component_Journalist_Corporate_Workstation_News_Organization -> component_News_Organization___Legal_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "3. Organizational /\nlegal exposure";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Journalist_Corporate_Workstation as Journalist Corporate Workstation
    link Journalist_Corporate_Workstation: Component @ component_Journalist_Corporate_Workstation.html
    participant SMTP_relay as SMTP relay
    link SMTP_relay: Component @ component_SMTP_relay.html
    participant News_Organization___Legal as News Organization / Legal
    link News_Organization___Legal: Component @ component_News_Organization___Legal.html

    Journalist->>Journalist_Corporate_Workstation: 1. Journalist uses corporate device
    SMTP_relay->>Journalist_Corporate_Workstation: 2. Alerts to corporate mail
    Journalist_Corporate_Workstation->>News_Organization___Legal: 3. Organizational / legal exposure

Workstation: reading submissions

A journalist downloads, decrypts and opens submissions on the SecureDrop Workstation.

25 open threats, highest risk 6 medium · 54 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_proxy_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-proxy";
                URL = "component_sd_proxy.html";
                tooltip = "sd-proxy";
                margin = 0.02;
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;
            ]

            component_sys_firewall_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-firewall";
                URL = "component_sys_firewall.html";
                tooltip = "sys-firewall";
                margin = 0.02;
            ]

            component_sys_net_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-net";
                URL = "component_sys_net.html";
                tooltip = "sys-net";
                margin = 0.02;
            ]

        }

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Use the client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_proxy_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist API\nrequest";    ]
    component_sd_proxy_Workstation_VMs -> component_sys_firewall_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Route via\nfirewall";    ]
    component_sys_firewall_Workstation_VMs -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "4. Route to network";    ]
    component_sys_net_Workstation_VMs -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Reach the\nJournalist Interface";    ]
    component_Journalist_Interface_Application_Server -> component_sys_net_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Encrypted\nsubmissions";    ]
    component_sd_proxy_Workstation_VMs -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "7. Relay to client";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Decrypt";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "9. Open a file";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "10. Send logs";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant sd_app__SecureDrop_Client_ as sd-app (SecureDrop Client)
    link sd_app__SecureDrop_Client_: Component @ component_sd_app__SecureDrop_Client_.html
    participant sd_proxy as sd-proxy
    link sd_proxy: Component @ component_sd_proxy.html
    participant sys_firewall as sys-firewall
    link sys_firewall: Component @ component_sys_firewall.html
    participant sys_net as sys-net
    link sys_net: Component @ component_sys_net.html
    participant Journalist_Interface as Journalist Interface
    link Journalist_Interface: Component @ component_Journalist_Interface.html
    participant sd_gpg as sd-gpg
    link sd_gpg: Component @ component_sd_gpg.html
    participant sd_viewer__disposable_VMs_ as sd-viewer (disposable VMs)
    link sd_viewer__disposable_VMs_: Component @ component_sd_viewer__disposable_VMs_.html
    participant sd_log as sd-log
    link sd_log: Component @ component_sd_log.html

    Journalist->>sd_app__SecureDrop_Client_: 1. Use the client
    sd_app__SecureDrop_Client_->>sd_proxy: 2. Journalist API request
    sd_proxy->>sys_firewall: 3. Route via firewall
    sys_firewall->>sys_net: 4. Route to network
    sys_net->>Journalist_Interface: 5. Reach the Journalist Interface
    Journalist_Interface-->>sys_net: 6. Encrypted submissions
    sd_proxy-->>sd_app__SecureDrop_Client_: 7. Relay to client
    sd_app__SecureDrop_Client_->>sd_gpg: 8. Decrypt
    sd_app__SecureDrop_Client_->>sd_viewer__disposable_VMs_: 9. Open a file
    sd_app__SecureDrop_Client_->>sd_log: 10. Send logs

Workstation: export and print

A journalist exports a submission to a USB drive or prints it.

17 open threats, highest risk 6 medium · 31 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_app__SecureDrop_Client__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-app\n(SecureDrop\nClient)";
                URL = "component_sd_app__SecureDrop_Client_.html";
                tooltip = "sd-app (SecureDrop Client)";
                margin = 0.02;
            ]

            component_sd_devices__export_and_print__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-devices\n(export and\nprint)";
                URL = "component_sd_devices__export_and_print_.html";
                tooltip = "sd-devices (export and print)";
                margin = 0.02;
            ]

            component_sd_log_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-log";
                URL = "component_sd_log.html";
                tooltip = "sd-log";
                margin = 0.02;
            ]

            component_sd_viewer__disposable_VMs__Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-viewer\n(disposable VMs)";
                URL = "component_sd_viewer__disposable_VMs_.html";
                tooltip = "sd-viewer (disposable VMs)";
                margin = 0.02;
            ]

            component_sys_usb_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sys-usb";
                URL = "component_sys_usb.html";
                tooltip = "sys-usb";
                margin = 0.02;
            ]

        }

    }

    component_Export_Device_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Export Device";
        URL = "component_Export_Device.html";
        tooltip = "Export Device";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_sd_app__SecureDrop_Client__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "1. Choose export";    ]
    component_sd_app__SecureDrop_Client__Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "2. Hand file to\nexport VM";    ]
    component_sys_usb_Workstation_VMs -> component_sd_devices__export_and_print__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "3. Attach USB device";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_Export_Device_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Write to drive";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_viewer__disposable_VMs__Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "5. Preview in\ndisposable VM";    ]
    component_sd_devices__export_and_print__Workstation_VMs -> component_sd_log_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "6. Send logs";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant sd_app__SecureDrop_Client_ as sd-app (SecureDrop Client)
    link sd_app__SecureDrop_Client_: Component @ component_sd_app__SecureDrop_Client_.html
    participant sd_devices__export_and_print_ as sd-devices (export and print)
    link sd_devices__export_and_print_: Component @ component_sd_devices__export_and_print_.html
    participant sys_usb as sys-usb
    link sys_usb: Component @ component_sys_usb.html
    participant Export_Device as Export Device
    link Export_Device: Component @ component_Export_Device.html
    participant sd_viewer__disposable_VMs_ as sd-viewer (disposable VMs)
    link sd_viewer__disposable_VMs_: Component @ component_sd_viewer__disposable_VMs_.html
    participant sd_log as sd-log
    link sd_log: Component @ component_sd_log.html

    Journalist->>sd_app__SecureDrop_Client_: 1. Choose export
    sd_app__SecureDrop_Client_->>sd_devices__export_and_print_: 2. Hand file to export VM
    sys_usb->>sd_devices__export_and_print_: 3. Attach USB device
    sd_devices__export_and_print_->>Export_Device: 4. Write to drive
    sd_devices__export_and_print_->>sd_viewer__disposable_VMs_: 5. Preview in disposable VM
    sd_devices__export_and_print_->>sd_log: 6. Send logs

Workstation: boot, provisioning and updates

The workstation boots, is provisioned by an administrator, and keeps its VMs updated.

12 open threats, highest risk 9 high · 39 threats in all

Data Flow Diagram

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Workstation {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Workstation</i>>;
        ]

        subgraph cluster_boundary_Workstation_VMs {
            graph [
                fontsize = 10;
                fontcolor = black;
                style = dashed;
                color = firebrick2;
                label = <<i>Workstation VMs</i>>;
            ]

            component_sd_gpg_Workstation_VMs [
                shape = circle;
                color = black;
                fontcolor = black;
                label = "sd-gpg";
                URL = "component_sd_gpg.html";
                tooltip = "sd-gpg";
                margin = 0.02;
            ]

        }

        component_Qubes_OS_and_Xen_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Qubes OS and Xen";
            URL = "component_Qubes_OS_and_Xen.html";
            tooltip = "Qubes OS and Xen";
            margin = 0.02;
        ]

        component_Workstation_bootloader_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nbootloader";
            URL = "component_Workstation_bootloader.html";
            tooltip = "Workstation bootloader";
            margin = 0.02;
        ]

        component_Workstation_firmware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nfirmware";
            URL = "component_Workstation_firmware.html";
            tooltip = "Workstation firmware";
            margin = 0.02;
        ]

        component_Workstation_hardware_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nhardware";
            URL = "component_Workstation_hardware.html";
            tooltip = "Workstation hardware";
            margin = 0.02;
        ]

        component_Workstation_provisioning_code_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Workstation\nprovisioning\ncode";
            URL = "component_Workstation_provisioning_code.html";
            tooltip = "Workstation provisioning code";
            margin = 0.02;
        ]

        component_dom0_SecureDrop_Workstation [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "dom0";
            URL = "component_dom0.html";
            tooltip = "dom0";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Workstation_hardware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "1. Power on";    ]
    component_Workstation_hardware_SecureDrop_Workstation -> component_Workstation_firmware_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "2. Start firmware";    ]
    component_Workstation_firmware_SecureDrop_Workstation -> component_Workstation_bootloader_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "3. Load bootloader";    ]
    component_Workstation_bootloader_SecureDrop_Workstation -> component_Qubes_OS_and_Xen_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "4. Boot Qubes";    ]
    component_Qubes_OS_and_Xen_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "5. Start dom0";    ]
    actor_Administrator_ -> component_Workstation_provisioning_code_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "6. Install and\nconfigure";    ]
    component_Workstation_provisioning_code_SecureDrop_Workstation -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "7. Apply salt states";    ]
    component_dom0_SecureDrop_Workstation -> component_sd_gpg_Workstation_VMs [        color = black;        fontcolor = black;        dir = forward;        label = "8. Provide secret\nkeys";    ]
    component_dom0_SecureDrop_Workstation -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "9. Fetch updates";    ]
    component_FPF_apt_repository_External_Services -> component_dom0_SecureDrop_Workstation [        color = black;        fontcolor = black;        dir = forward;        label = "10. Signed packages";    ]
}

Sequence Diagram

sequenceDiagram
    participant Journalist as Journalist
    link Journalist: Component @ component_Journalist.html
    participant Workstation_hardware as Workstation hardware
    link Workstation_hardware: Component @ component_Workstation_hardware.html
    participant Workstation_firmware as Workstation firmware
    link Workstation_firmware: Component @ component_Workstation_firmware.html
    participant Workstation_bootloader as Workstation bootloader
    link Workstation_bootloader: Component @ component_Workstation_bootloader.html
    participant Qubes_OS_and_Xen as Qubes OS and Xen
    link Qubes_OS_and_Xen: Component @ component_Qubes_OS_and_Xen.html
    participant dom0 as dom0
    link dom0: Component @ component_dom0.html
    participant Administrator as Administrator
    link Administrator: Component @ component_Administrator.html
    participant Workstation_provisioning_code as Workstation provisioning code
    link Workstation_provisioning_code: Component @ component_Workstation_provisioning_code.html
    participant sd_gpg as sd-gpg
    link sd_gpg: Component @ component_sd_gpg.html
    participant FPF_apt_repository as FPF apt repository
    link FPF_apt_repository: Component @ component_FPF_apt_repository.html

    Journalist->>Workstation_hardware: 1. Power on
    Workstation_hardware->>Workstation_firmware: 2. Start firmware
    Workstation_firmware->>Workstation_bootloader: 3. Load bootloader
    Workstation_bootloader->>Qubes_OS_and_Xen: 4. Boot Qubes
    Qubes_OS_and_Xen->>dom0: 5. Start dom0
    Administrator->>Workstation_provisioning_code: 6. Install and configure
    Workstation_provisioning_code->>dom0: 7. Apply salt states
    dom0->>sd_gpg: 8. Provide secret keys
    dom0->>FPF_apt_repository: 9. Fetch updates
    FPF_apt_repository-->>dom0: 10. Signed packages