Admin Tails USB stick tampered accepted Legacy (Tails/SVS)

THREAT97 · Accepted: The team has decided to live with this risk. · Defined in catalog.py:1690

Risk: High impact × Low likelihood = 6 medium
After mitigations: High impact × Low likelihood = 6 medium (unchanged)

How statuses and scores work

An adversary tampers the Administrator's Tails USB stick and inserts malware

Threat actors: Nation State / Law Enforcement

Mitigations

No mitigations in place.

Possible further mitigations

Tamper-evident stickers/bags MITIG116 Legacy (Tails/SVS) proposed
Admin guide should speak clearly to physical security considerations MITIG115 proposed
Admin guide explains incident response when admin tails key is tampered with / compromised MITIG141 Legacy (Tails/SVS) proposed

Residual risk

Candidate for further mitigation efforts.

Where it applies

Applies to 1 component in 1 scenario.

Admin Workstation (device) Legacy (Tails/SVS) Admin Workstation (Tails)

Workstation lifecycle and backups Legacy (Tails/SVS) · Admin Workstation (device)

digraph tm {
    graph [
        fontname = Arial;
        fontsize = 14;
    ]
    node [
        fontname = Arial;
        fontsize = 14;
    ]
    edge [
        fontname = Arial;
        fontsize = 12;
    ]
    nodesep = 1;

    subgraph cluster_boundary_Admin_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Admin Workstation (Tails)</i>>;
        ]

        component_Admin_Workstation__device__Admin_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Admin\nWorkstation\n(device)";
            URL = "component_Admin_Workstation__device_.html";
            tooltip = "Admin Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;

            style = "filled,dashed";

            fillcolor = "#c0392b";

            fontcolor = "white";

            class = "tagged highlighted";
        ]

    }

    subgraph cluster_boundary_Journalist_Workstation__Tails_ {
        graph [
            fontsize = 10;
            fontcolor = black;
            style = dashed;
            color = firebrick2;
            label = <<i>Journalist Workstation (Tails)</i>>;
        ]

        component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [
            shape = circle;
            color = black;
            fontcolor = black;
            label = "Journalist\nWorkstation\n(device)";
            URL = "component_Journalist_Workstation__device_.html";
            tooltip = "Journalist Workstation (device) (Legacy (Tails/SVS))";
            margin = 0.02;
            style = "dashed";
            class = "tagged";
        ]

    }

    actor_Administrator_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Administrator";
        URL = "component_Administrator.html";
        tooltip = "Administrator";
        margin = 0.02;
    ]

    component_Backup___recovery_media_ [
        shape = circle;
        color = black;
        fontcolor = black;
        label = "Backup /\nrecovery media";
        URL = "component_Backup___recovery_media.html";
        tooltip = "Backup / recovery media";
        margin = 0.02;
    ]

    actor_Journalist_ [
        shape = square;
        color = black;
        fontcolor = black;
        label = "Journalist";
        URL = "component_Journalist.html";
        tooltip = "Journalist";
        margin = 0.02;
    ]

    actor_Administrator_ -> component_Admin_Workstation__device__Admin_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "1. Admin operates\nworkstation";    ]
    actor_Journalist_ -> component_Journalist_Workstation__device__Journalist_Workstation__Tails_ [        color = black;        fontcolor = black;        dir = forward;        label = "2. Journalist\noperates workstation";    ]
    component_Admin_Workstation__device__Admin_Workstation__Tails_ -> component_Backup___recovery_media_ [        color = black;        fontcolor = black;        dir = forward;        label = "3. Back up secrets";    ]
}

Notes

Further mitigations: Admin guide should emphasize on physical security of admin stick, and suggest tamper-evident mechanisms for admin sticks (bags) (MITIG116). Admins should be instructed to keep their sticks with them or in a secure location at all times (MITIG115). Inform users to immediately discard existing key and change Administrator credentials should there be any doubt that the Admin tails key was tampered. This includes SSH key and Authenticated tor hidden service cookies (MITIG141). Automated test for mitigation: No.

How this threat is matched

Listed for these components. A boundary covers every component inside it.