Source uses employer/corporate device inform

THREAT78 · Inform: Handled by telling users how to protect themselves. · Defined in catalog.py:1374

Risk: Medium impact × Medium likelihood = 6 medium
After mitigations: Medium impact × Low likelihood = 4 medium

Corporation may use device management and network monitoring software that would be able to identify a source's activity (even if Tor Browser is installed on the corporate device). Sources must not use an employer's device or network to leak documents

Threat actors: Source error

Mitigations

Mitigation	Status
Guidelines for OPSEC in the landing page MITIG42	optional
Source guide contains some OPSEC considerations MITIG86	implemented

Possible further mitigations

Sources instructed to use a non-monitored network (e.g. coffee shop) for Tor activity MITIG156 proposed
Guidelines for OPSEC in the landing page MITIG42 optional

Residual risk

Sources might not find the source guide. Landing page may not contain all recommendations.

Where it applies

Applies to 1 component in 1 scenario.

Source environment Source Area

Source discovery and OPSEC · Source environment

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_External_Services {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>External Services</i>>;
        ]

        component_Landing_page_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Landing page";
            URL = "component_Landing_page.html";
            tooltip = "Landing page";
            margin = 0.02;
        ]

        component_SecureDrop_org_directory_External_Services [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "SecureDrop.org\ndirectory";
            URL = "component_SecureDrop_org_directory.html";
            tooltip = "SecureDrop.org directory";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_SecureDrop_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>SecureDrop Area</i>>;
        ]

        component_Dedicated_Hardware_Firewall_SecureDrop_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Dedicated\nHardware\nFirewall";
            URL = "component_Dedicated_Hardware_Firewall.html";
            tooltip = "Dedicated Hardware Firewall";
            margin = 0.02;
        ]

    }

    subgraph cluster_boundary_Source_Area {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Source Area</i>>;
        ]

        actor_Source_Source_Area [
            shape = square;
            color = black;
            fontcolor = black;
            label = "Source";
            URL = "component_Source.html";
            tooltip = "Source";
            margin = 0.02;
        ]

        component_Source_Tor_Browser_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source Tor\nBrowser";
            URL = "component_Source_Tor_Browser.html";
            tooltip = "Source Tor Browser";
            margin = 0.02;
        ]

        component_Source_environment_Source_Area [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Source\nenvironment";
            URL = "component_Source_environment.html";
            tooltip = "Source environment";
            margin = 0.02;

            style = "filled";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "highlighted";
        ]

    }

    actor_Source_Source_Area -> component_Source_environment_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "1. Research / browse";    ]
    component_Source_environment_Source_Area -> component_SecureDrop_org_directory_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "2. Check directory";    ]
    component_Source_environment_Source_Area -> component_Landing_page_External_Services [        color = black;        fontcolor = black;        dir = forward;        label = "3. Visit landing\npage";    ]
    actor_Source_Source_Area -> component_Source_Tor_Browser_Source_Area [        color = black;        fontcolor = black;        dir = forward;        label = "4. Open Tor Browser";    ]
    component_Source_Tor_Browser_Source_Area -> component_Dedicated_Hardware_Firewall_SecureDrop_Area [        color = black;        fontcolor = black;        dir = forward;        label = "5. Connect to onion";    ]
}

Notes

Existing mitigations: Securedrop source guide instructs users to not leak documents using employer devices or network: https://docs.securedrop.org/en/stable/source.html (MITIG42, MITIG86). Further mitigations: SecureDrop source interface should clearly state not to use employer's network to leak documents (MITIG156). MITIG42 should be required, not optional. Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.