Threats by status What the statuses mean
84
Open
8
unmanaged
76
partially mitigated
49
accepted
3
transferred
34
inform
1
avoided
53
mitigated
9
out of scope
Top open risks All open threats →
The highest risks after mitigations among unmanaged and partially mitigated threats that apply to a component.
Scenarios See all scenarios →
- Source submission Anonymous source submits over Tor; app encrypts and stores it.
- Journalist triage Authenticated journalist browses and downloads encrypted submissions.
- Transfer & decrypt Legacy (Tails/SVS) Encrypted submission is carried to the SVS, decrypted and sanitized.
- Publish & export Legacy (Tails/SVS) Sanitized output leaves the air-gap to the publishing area or print.
- Admin access Admin reaches both servers over SSH on authenticated Tor onions.
- Monitoring & alerting OSSEC watches the app server; encrypted alerts are mailed to admins.
- Updates, time & DNS App server reaches package/time/DNS services via the monitor gateway.
- Source discovery and OPSEC How a source finds the instance and the pre-submission OPSEC surface.
- Supply chain and dependencies Source code is built, signed, published, and installed on the servers.
- Workstation lifecycle and backups Legacy (Tails/SVS) Physical/lifecycle threat surface of the admin and journalist Tails devices.
- Physical and host layer Host/OS and physical room surface.
- Corporate and legal zone News-org corporate/personal environment and legal exposure (largely out of scope).
- Workstation: reading submissions A journalist downloads, decrypts and opens submissions on the SecureDrop Workstation.
- Workstation: export and print A journalist exports a submission to a USB drive or prints it.
- Workstation: boot, provisioning and updates The workstation boots, is provisioned by an administrator, and keeps its VMs updated.