Admin workstation backup stick is compromised accepted
THREAT2
· Accepted: The team has decided to live with this risk.
· Defined in catalog.py:46
- Risk
- Medium impact × Low likelihood = 4 medium
- After mitigations
- Medium impact × Low likelihood = 4 medium (unchanged)
While there is no formal recommendation in the Admin guide, it is possible for an Admin to create an encrypted USB stick for disaster recovery purposes. An adversary successfully acquires the SecureDrop backup stick containing all secrets for the SecureDrop instance and associated infrastructure.
Threat actors: Nation State / Law Enforcement Large Corporation
Mitigations
| Mitigation | Status |
|---|---|
| Persistent storage FDE for Admin Workstation MITIG12 | implemented |
Possible further mitigations
- Admin guide explains security considerations of backup drive and the incident response if compromised MITIG219 proposed
Residual risk
Risk is accepted
Where it applies
Applies to 1 component in 1 scenario.
Workstation lifecycle and backups Legacy (Tails/SVS) · Backup / recovery media
Notes
Existing mitigations: Admin key persistence volume is encrypted with LUKS/dm-crypt (MITIG12). Further mitigations: Admin guide should state that security of SecureDrop instance in the event of the loss of a backup or admin stick rests on the strength of the persistent volume passphrase. Should the backup or Admin stick be lost, consider rotating all SecureDrop secrets and rotating the persistent volume encryption key. (MITIG219). Automated test for mitigation: No.
How this threat is matched
Listed for these components. A boundary covers every component inside it.