Model internals

These views are made for the threat-model writers, and show how threats are matched to components and how the properties and mitigations apply.

• Components: every component in the model, with its properties.
• Threats × components matrix: every threat we list, against every component in our model.

Component properties

• Assume Not Compromised The attacker should not get in this environment
• Executes Commands Whether a comopnent can call an external command
• Executes Scripts Can execute scripts in files, system, or from remote sources
• Is Backed Up
• Is Build Artifact
• Is Code
• Is Discoverable You can find information about it or discover it on the Internet
• Is Exposed
• Is Fuzzed Whether a component has been fuzzed by us as part of CI/CD
• Is Memory Safe
• Is Physical
• Is Privileged
• Is Reproducible
• Is Reputable Strong signal that the author of the software and its users will not allow a malicious package
• Is Resource Constrained
• Is Reviewed
• Is Sandboxed The attacker cannot get out of this environment
• Is Secret Whether an artifact is confidential/secret
• Is Verifiable
• Loads Resources Loads resources external to the program. Currently, the resources that we take into account are: * caches: for example container image caches * system: any resource from the system, such as libraries, binaries, environment variables, configuration files. All but the most trivial programs load such resources (default) * images: Container images that we pull * deps: Build dependencies from the internet like PyPI packages, vendored assets, packages * updates: update information from the Internet
• Publishes Code
• Reads Input Reads any type of input from a socket, fd, arguments
• Requires Credentials For services that require credentials in order to use them
• Sanitizes Input Implies that it also validates the input
• Sanitizes Output
• Uses Network Anything that may connect to the network
• Uses Strong Credentials Assumption: the credentials we use are vetted to be strong
• Uses Strong Crypto
• Verifies Resources Verifies resources external to the program. See `loads_resources` for info about resource types
• Works Offline if the component can work even without network (not necessarily air-gapped)
• Writes To Terminal