Failure to segregate Securedrop environment from corporate environment or personal environment partially mitigated Legacy (Tails/SVS)

THREAT120 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2066

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

An admin or journalist fails to segregate the SecureDrop environment from their corporate environment. This includes storing SecureDrop-specific passwords in corporate password storage tools and re-using passwords. Should the corporate environment be compromised, the SecureDrop environment is at risk of being compromised by the adversary as they pivot through the news organization's environment.

Threat actors: Journalist error

Mitigations

Mitigation	Status
Use of airgapped SVS key MITIG10	implemented
Passphrases for journalists and admins are generated to be 7 word diceware MITIG49	implemented

Possible further mitigations

Journalists/admins encouraged not to reuse credentials MITIG146 Legacy (Tails/SVS) proposed

Residual risk

Candidate for further mitigation efforts.

Where it applies

Applies to 2 components in 1 scenario.

Admin Workstation (device) Legacy (Tails/SVS) Admin Workstation (Tails)
Journalist Workstation (device) Legacy (Tails/SVS) Journalist Workstation (Tails)

Workstation lifecycle and backups Legacy (Tails/SVS) · Admin Workstation (device), Journalist Workstation (device)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Admin_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Admin Workstation (Tails)</i>>;
        ]

        component_Admin_Workstation__device__Admin_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Admin\nWorkstation\n(device)";
            URL = "component_Admin_Workstation__device_.html";
            tooltip = "Admin Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Journalist_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Journalist Workstation (Tails)</i>>;
        ]

        component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nWorkstation\n(device)";
            URL = "component_Journalist_Workstation__device_.html";
            tooltip = "Journalist Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_Backup___recovery_media_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Backup /\nrecovery media";
        URL = "component_Backup___recovery_media.html";
        tooltip = "Backup / recovery media";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Admin_Workstation__device__Admin_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Admin operates\nworkstation";    ]
    actor_Journalist_ -> component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist\noperates workstation";    ]
    component_Admin_Workstation__device__Admin_Workstation__Tails_ -> component_Backup___recovery_media_ [        color = black;        fontcolor = black;        dir = forward;        label = "3. Back up secrets";    ]
}

Notes

Existing mitigations: Submissions are encrypted using an airgapped GPG key only used in the SecureDrop environment (MITIG10). Credentials on journalist interface generated by SecureDrop to prevent credential reuse (MITIG49). Further mitigations: Journalist and admin guide should provide further guidance as to avoid password reuse and proper generation of diceware passphrases for the Tails Persistent volume. Once in the Tails Persistent volume, all SecureDrop-relevant passwords should be stored in a password manager (e.g. KeypassX) (MITIG146). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.