Monitor server is compromised accepted

THREAT66 · Accepted: The team has decided to live with this risk. · Defined in catalog.py:1158

Risk: Medium impact × Low likelihood = 4 medium
After mitigations: Medium impact × Low likelihood = 4 medium (unchanged)

Due to limited attack surface (only SSH is exposed through an authenticated Tor hidden service) and port 1515 only locally to app server, if the monitor server is compromised, we should assume the app server is as well. Mon server also makes outbound calls to SMTP relay.

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
ATHS token for connecting to servers via SSH MITIG60	optional
Use of external dedicated hardware firewall MITIG21	implemented
Restrictive iptables rules on servers MITIG182	implemented
Nighly security update MITIG165	implemented
Use of grsecurity-hardened kernels on servers MITIG53	implemented
AppArmor on Tor MITIG1	implemented
AppArmor on Apache MITIG2	implemented
Use of OSSEC monitoring software MITIG5	implemented

Residual risk

Risk is accepted

Where it applies

Applies to 1 component in 1 scenario.

Monitoring Server (host) Monitoring Server

Physical and host layer · Monitoring Server (host)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Application_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Application Server</i>>;
        ]

        component_Application_Server__host__Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Application\nServer (host)";
            URL = "component_Application_Server__host_.html";
            tooltip = "Application Server (host)";
            margin = 0.02;
        ]

        component_SecureDrop_Application_Application_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nApplication";
            URL = "component_SecureDrop_Application.html";
            tooltip = "SecureDrop Application";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Monitoring_Server {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Monitoring Server</i>>;
        ]

        component_Monitoring_Server__host__Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Monitoring\nServer (host)";
            URL = "component_Monitoring_Server__host_.html";
            tooltip = "Monitoring Server (host)";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

        component_OSSEC_server_Monitoring_Server [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "OSSEC server";
            URL = "component_OSSEC_server.html";
            tooltip = "OSSEC server";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_SecureDrop_server_room_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop\nserver room";
            URL = "component_SecureDrop_server_room.html";
            tooltip = "SecureDrop server room";
            margin = 0.02;
        ]

    }

    component_SecureDrop_Application_Application_Server -> component_Application_Server__host__Application_Server [        color = black;        fontcolor = black;        dir = forward;        label = "1. Services on app\nhost";    ]
    component_OSSEC_server_Monitoring_Server -> component_Monitoring_Server__host__Monitoring_Server [        color = black;        fontcolor = black;        dir = forward;        label = "2. Services on mon\nhost";    ]
    component_Application_Server__host__Application_Server -> component_SecureDrop_server_room_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "3. Hosts in server\nroom";    ]
}

Notes

Existing mitigations: mon server should only exposes SSH via Tor hidden service (MITIG60). All other traffic should be blocked by firewall (MITIG21, MITIG182). FPF performs vulnerability management for software dependencies as well automatic nightly updates for dependencies and OS packages (MITIG165). grsecurity/PaX linux patches prevent the exploitation of certain memory-corruption attacks (MITIG53). AppArmor profiles further reduce process capabilities through Mandatory Access Control (MITIG1, MITIG2). OSSEC is used for intrusion detection/file integrity monitoring (MITIG5). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.