Attacks on the journalist corporate workstation (malware/seized/tampered) out of scope

THREAT55 · Out of scope: Outside what this threat model covers. · Defined in catalog.py:977

Risk: Unknown impact × Unknown likelihood = Unknown
After mitigations: Unknown impact × Unknown likelihood = Unknown (unchanged)

Journalist corporate environment is out-of-scope. SecureDrop Infrastructure should be segregated and must not depend on the security of the corporate environment.

Threat actors: Nation State / Law Enforcement Large Corporation

Mitigations

No mitigations in place.

Possible further mitigations

Journalist guide has detailed information about removing metadata and handling the malware threat MITIG88 proposed

Where it applies

Applies to 1 component in 1 scenario.

Journalist Corporate Workstation News Organization

Corporate and legal zone · Journalist Corporate Workstation

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_SMTP_relay_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SMTP relay";
            URL = "component_SMTP_relay.html";
            tooltip = "SMTP relay";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_News_Organization {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>News Organization</i>>;
        ]

        component_Journalist_Corporate_Workstation_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nCorporate\nWorkstation";
            URL = "component_Journalist_Corporate_Workstation.html";
            tooltip = "Journalist Corporate Workstation";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_News_Organization___Legal_News_Organization [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "News\nOrganization /\nLegal";
            URL = "component_News_Organization___Legal.html";
            tooltip = "News Organization / Legal";
            margin = 0.02;
        ]

    }

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Journalist_ -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "1. Journalist uses\ncorporate device";    ]
    component_SMTP_relay_External_Services -> component_Journalist_Corporate_Workstation_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "2. Alerts to\ncorporate mail";    ]
    component_Journalist_Corporate_Workstation_News_Organization -> component_News_Organization___Legal_News_Organization [        color = black;        fontcolor = black;        dir = forward;        label = "3. Organizational /\nlegal exposure";    ]
}

Notes

Existing mitigations: Once submissions reach the journalist workstation for publishing, they should be considered adequately sanitized. Further mitigations: Journalist guide should state that all data is sanitized before leaving the SVS and/or Tails workstation. Journalist guide should also include operational security guidelines. (MITIG88). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.