Firewall rule misconfiguration on application server partially mitigated

THREAT31 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:541

Risk: High impact × Medium likelihood = 9 high
After mitigations: Low impact × Medium likelihood = 3 low

How statuses and scores work

Intentional or accidental configuration of the application server firewall rules may introduce vulnerabilities in the Application Server.

Threat actors: Administrator error

Mitigations

Mitigation	Status
Use of Ansible for configuration management for servers MITIG61	implemented
Use of external dedicated hardware firewall MITIG21	implemented

Possible further mitigations

Instruct admins not to modify config by hand MITIG62 proposed
securedrop-admin script to audit config of running servers MITIG65 proposed

Residual risk

Administrator error or omission

Where it applies

Applies to 1 component in 1 scenario.

Application Server (host) Application Server

Physical and host layer · Application Server (host)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Notes

Existing mitigations: All SecureDrop infrastructure is provisioned via infrastructure-as-code (Ansible scripts). (MITIG61), presence of hardware firewall provides defense-in-depth (MITIG21). Further mitigations: Instruct Administrators to not modify by hand the configuration of the SecureDrop Application server (MITIG62). Develop a Securedrop-admin audit script which audits the current running configuration of Application server security-critical services (MITIG65). Automated test for mitigation: Yes.

How this threat is matched

Listed for these components. A boundary covers every component inside it.