Admin laptop tampered partially mitigated Legacy (Tails/SVS)

THREAT95 · Partially mitigated: Some controls are in place, but the risk is still too high. · Defined in catalog.py:1655

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

An adversary seizes the Administrator's Tails workstation and introduces an implant.

Threat actors: Nation State / Law Enforcement

Mitigations

Mitigation	Status
SecureDrop hardware encouraged to be stored in a secure room / safe / environment MITIG114 Legacy (Tails/SVS)	optional

Possible further mitigations

Admin guide should speak clearly to physical security considerations MITIG115 proposed
Tamper-evident stickers/bags MITIG116 Legacy (Tails/SVS) proposed
Chassis intrusion detection MITIG117 Legacy (Tails/SVS) proposed

Residual risk

Not uniformly applied across organizations.

Where it applies

Applies to 1 component in 1 scenario.

Admin Workstation (device) Legacy (Tails/SVS) Admin Workstation (Tails)

Workstation lifecycle and backups Legacy (Tails/SVS) · Admin Workstation (device)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Admin_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Admin Workstation (Tails)</i>>;
        ]

        component_Admin_Workstation__device__Admin_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Admin\nWorkstation\n(device)";
            URL = "component_Admin_Workstation__device_.html";
            tooltip = "Admin Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Journalist_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Journalist Workstation (Tails)</i>>;
        ]

        component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nWorkstation\n(device)";
            URL = "component_Journalist_Workstation__device_.html";
            tooltip = "Journalist Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_Backup___recovery_media_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Backup /\nrecovery media";
        URL = "component_Backup___recovery_media.html";
        tooltip = "Backup / recovery media";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Admin_Workstation__device__Admin_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Admin operates\nworkstation";    ]
    actor_Journalist_ -> component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist\noperates workstation";    ]
    component_Admin_Workstation__device__Admin_Workstation__Tails_ -> component_Backup___recovery_media_ [        color = black;        fontcolor = black;        dir = forward;        label = "3. Back up secrets";    ]
}

Notes

Existing mitigations: Organizations are encouraged to store admin laptops in secure rooms / locations (MITIG114). Further mitigations: Admin guide should emphasize on physical security of admin workstation (MITIG115), and suggest tamper-evident mechanisms for admin workstations (tamper-evident stickers/bags) (MITIG116). Some laptops have chassis intrusion detection, which combined with a power-on password may also provide extra assurance (MITIG117). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.