Hardware Firewall Misconfiguration mitigated

THREAT49 · Mitigated: Controls in place bring the risk down to an acceptable level. · Defined in catalog.py:877

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Low impact × Low likelihood = 2 low

An administrator misconfigures the hardware firewall and allows inbound communication to ports that should be restricted

Threat actors: Administrator error

Mitigations

Mitigation	Status
Restrictive iptables rules on servers MITIG182	implemented

Where it applies

Applies to 1 component in 5 scenarios.

Dedicated Hardware Firewall SecureDrop Area

Source submission · Dedicated Hardware Firewall

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

        component_Source_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Interface";
            URL = "component_Source_Interface.html";
            tooltip = "Source Interface";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Submit over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Source_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Source\nInterface";    ]
    component_Source_Interface_Application_Server -> component_SecureDrop_Application_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hand to app";    ]
    component_SecureDrop_Application_Application_Server -> component_Encrypted_submission_store_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "4. Encrypt & store";    ]
    component_SecureDrop_Application_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "5. Record metadata";    ]
}

Journalist triage · Dedicated Hardware Firewall

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Encrypted_submission_store_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Encrypted\nsubmission store";
            URL = "component_Encrypted_submission_store.html";
            tooltip = "Encrypted submission store";
            margin = 0.02;
        ]

        component_Journalist_Interface_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nInterface";
            URL = "component_Journalist_Interface.html";
            tooltip = "Journalist Interface";
            margin = 0.02;
        ]

        component_Metadata_DB_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Metadata DB";
            URL = "component_Metadata_DB.html";
            tooltip = "Metadata DB";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Authenticate over\nTor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Journalist_Interface_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Reach Journalist\nInterface";    ]
    component_Journalist_Interface_Application_Server -> component_Metadata_DB_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. List sources";    ]
    component_Encrypted_submission_store_Application_Server -> actor_Journalist_ [        color = black;        fontcolor = black;        dir = forward;        label = "4. Download\nencrypted";    ]
}

Admin access · Dedicated Hardware Firewall

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_SSH_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server SSH";
            URL = "component_App_Server_SSH.html";
            tooltip = "App Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_SSH_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nSSH";
            URL = "component_Monitor_Server_SSH.html";
            tooltip = "Monitor Server SSH";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. SSH over Tor";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_App_Server_SSH_Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Admin App Server";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Monitor_Server_SSH_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "3. Admin Monitor\nServer";    ]
}

Updates, time & DNS · Dedicated Hardware Firewall

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_App_Server_APT_NTP_DNS_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "App Server\nAPT/NTP/DNS";
            URL = "component_App_Server_APT_NTP_DNS.html";
            tooltip = "App Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_DNS_resolver_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "DNS resolver";
            URL = "component_DNS_resolver.html";
            tooltip = "DNS resolver";
            margin = 0.02;
        ]

        component_FPF_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "FPF apt\nrepository";
            URL = "component_FPF_apt_repository.html";
            tooltip = "FPF apt repository";
            margin = 0.02;
        ]

        component_NTP_server_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "NTP server";
            URL = "component_NTP_server.html";
            tooltip = "NTP server";
            margin = 0.02;
        ]

        component_Ubuntu_apt_repository_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Ubuntu apt\nrepository";
            URL = "component_Ubuntu_apt_repository.html";
            tooltip = "Ubuntu apt repository";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitor Server\nAPT/NTP/DNS";
            URL = "component_Monitor_Server_APT_NTP_DNS.html";
            tooltip = "Monitor Server APT/NTP/DNS";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    component_App_Server_APT_NTP_DNS_Application_Server -> component_Monitor_Server_APT_NTP_DNS_Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Proxy via monitor";    ]
    component_Monitor_Server_APT_NTP_DNS_Monitoring_Server -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "2. Egress via\nfirewall";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_Ubuntu_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Ubuntu apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_FPF_apt_repository_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "4. FPF apt";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_NTP_server_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "5. NTP";    ]
    component_Dedicated_Hardware_Firewall_SecureDrop_Area -> component_DNS_resolver_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "6. DNS";    ]
}

Source discovery and OPSEC · Dedicated Hardware Firewall

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Notes

Existing mitigations: Host-based firewall (iptables) is also used on both SecureDrop application and Monitor servers (MITIG182). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.