OSSEC rules configuration error on application server partially mitigated

THREAT167 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:2862

Risk: High impact × Medium likelihood = 9 high
After mitigations: Medium impact × Medium likelihood = 6 medium

How statuses and scores work

Intentional or accidental configuration of the application server OSSEC rules may introduce vulnerabilities in the Application Server.

Threat actors: Administrator error

Mitigations

Mitigation	Status
Use of Ansible for configuration management for servers MITIG61	implemented

Possible further mitigations

Instruct admins not to modify config by hand MITIG62 proposed
securedrop-admin script to audit config of running servers MITIG65 proposed

Residual risk

Administrator error or omission

Where it applies

Applies to 1 component in 1 scenario.

OSSEC client Application Server

Monitoring & alerting · OSSEC client

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_OSSEC_client_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC client";
            URL = "component_OSSEC_client.html";
            tooltip = "OSSEC client";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

        component_Postfix_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Postfix";
            URL = "component_Postfix.html";
            tooltip = "Postfix";
            margin = 0.02;
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_OSSEC_client_Application_Server -> component_OSSEC_server_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Ship events";    ]
    component_OSSEC_server_Monitoring_Server -> component_Postfix_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Raise alert";    ]
    component_Postfix_Monitoring_Server -> component_SMTP_relay_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Relay mail";    ]
    component_SMTP_relay_External_Services -> actor_Administrator_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Deliver to admin";    ]
}

Notes

Existing mitigations: All SecureDrop infrastructure is provisioned via infrastructure-as-code (Ansible scripts). (MITIG61). Further mitigations: Instruct Administrators to not modify by hand the configuration of the SecureDrop Application server (MITIG62). Develop a Securedrop-admin audit script which audits the current running configuration of Application server security-critical services (MITIG65). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.