Journalist user performs malicious action under another user's account out of scope
THREAT170
· Out of scope: Outside what this threat model covers.
· Defined in catalog.py:2916
- Risk
- Medium impact × Low likelihood = 4 medium
- After mitigations
- Medium impact × Low likelihood = 4 medium (unchanged)
If a news organization incorrectly provisions a workstation such that users have access to other users' credentials, and a malicious journalist user obtains the 2FA token somehow, they may be able to impersonate other users and perform actions such as sending replies, deleting submissions, or marking sources as seen in another user's name. One motivation could be to interfere with a news org's operations without being detected.
Threat actors: Malicious journalist
Mitigations
| Mitigation | Status |
|---|---|
| 2FA token required for login to admin or journalist interfaces MITIG19 | implemented |
| Persistent storage FDE for Journalist Workstation MITIG13 | implemented |
Possible further mitigations
- Switch to a personal inbox model MITIG244 proposed
Residual risk
News orgs may not follow best practices in terms of per-journalist credentials.
Where it applies
Applies to 1 component in 2 scenarios.
Journalist triage · Journalist Interface
Workstation: reading submissions · Journalist Interface
Notes
Existing mitigations: 2FA for journalist accounts (MITIG19). FDE for Journalist Workstations (MITIG13), which should normally be individually keyed. Further mitigations: Switch to a personal inbox model to avoid global impact of individual journalist actions (MITIG244). Automated test for mitigation: Yes.
How this threat is matched
Listed for these components. A boundary covers every component inside it.