App server (physical) tampering partially mitigated

THREAT107 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:1862

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

SecureDrop application server physical security is compromised

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
Swap disabled on servers MITIG52	implemented
AppArmor on Tor MITIG1	implemented
AppArmor on Apache MITIG2	implemented
Use of OSSEC monitoring software MITIG5	implemented
Nighly reboot occurs to clear secrets stored in memory MITIG136	implemented

Possible further mitigations

Physical monitoring, e.g. Haven MITIG135 proposed
FDE on app/mon servers MITIG134 proposed
Admin guide should speak clearly to physical security considerations MITIG115 proposed

Residual risk

Candidate for further mitigation efforts.

Where it applies

Applies to 1 component in 1 scenario.

Application Server (host) Application Server

Physical and host layer · Application Server (host)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Notes

Existing mitigations: Swap is disabled (MITIG52). AppArmor for mandatory access control (MITIG1, MITIG2), and ossec for file integrity monitoring (MITIG5). Memory is cleared on daily reboot (MITIG136). Further mitigations: Physical security/surveillance (e.g. Haven) (MITIG135), ping checks, full-disk-encryption (MITIG134), explain physical security in admin guide (MITIG115). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.