91 lines
7.2 KiB
Markdown
91 lines
7.2 KiB
Markdown
# S Browser threat model and security acceptance gates
|
|
|
|
Status: implementation threat model, 2026-10-13. This is not an independent security
|
|
assessment. See `requirements-audit.md` for current implementation evidence.
|
|
|
|
## Assets and adversaries
|
|
|
|
Protect confidential document/prompt bytes, credential material, browser session
|
|
authority, signed policy versions, classification features, administrator identity,
|
|
audit integrity and availability. Hashes and semantic vectors are confidential
|
|
derived data, even though source documents are not retained.
|
|
|
|
Consider malicious sites and frames, hostile document/media files, malicious
|
|
clipboard instructions, compromised AI output, unauthorized local agents, stolen
|
|
device credentials, network interception, stale policy caches and unauthorized or
|
|
compromised management identities. A local OS administrator can replace executable
|
|
code or inspect process memory: protecting against that requires endpoint controls
|
|
outside this browser's present assurance boundary.
|
|
|
|
## Trust boundaries
|
|
|
|
1. **Remote site to privileged browser.** Website content has no trusted UI bridge,
|
|
Node access or administrative authority. Renderer requests and DOM observations
|
|
are untrusted; native policy checks own transfer decisions. Website appearance
|
|
cannot establish origin identity.
|
|
2. **Browser to clipboard/files/network.** Inspect before release. An approval must
|
|
bind destination, bytes, current policy and current target context. Unsupported
|
|
transfer paths remain blocked. Rich/file/subframe clipboard paths are not silently
|
|
downgraded to plain-text inspection.
|
|
3. **Document bytes to parser/model worker.** Authentication to the loopback broker
|
|
is separate from permission to parse a document. Untrusted documents must run in
|
|
a restricted worker with no broker credentials, host data access or network
|
|
capability. Job Objects limit resources but do not satisfy this boundary alone.
|
|
4. **Device to management.** Enrollment establishes device identity; it never
|
|
establishes admin authority. HTTPS, independently pinned policy keys, signed
|
|
monotone versions, expiries and authenticated device requests all remain required.
|
|
5. **Administrator to management.** Verified OIDC identity and exact role permissions
|
|
authorize every backend route. Hidden controls are a usability property. Session
|
|
revocation invalidates current cookies; removing an IdP group must also prevent
|
|
future logins. Mandatory independent approval is still a separate gate.
|
|
6. **Browser/AI gateway to approved model.** Classify locally/customer-side before
|
|
external transmission. Provider credentials stay at the gateway. Page content,
|
|
retrieved documents and model output cannot grant tool permissions or change
|
|
policies. Model similarity is evidence, not a proof of confidentiality absence.
|
|
7. **Local agent to browser.** Pairing capabilities are scoped, device-local and
|
|
revocable. Fixed actions validate the target/session again before execution.
|
|
No arbitrary JavaScript, CDP, cookie export or password export is exposed.
|
|
8. **Enforcement to audit/SIEM.** Record bounded metadata rather than source contents,
|
|
prompts or credentials. Durable event ingestion and deduplication are separate
|
|
from sampled operational traces. SIEM failures must retain a retryable backlog.
|
|
|
|
## Abuse cases and acceptance evidence
|
|
|
|
| ID | Abuse case | Required invariant / release test |
|
|
| --- | --- | --- |
|
|
| DLP-01 | Page swaps an approved file after scanning | Receiver obtains only the inspected immutable bytes; native file transfer binding is still open. |
|
|
| DLP-02 | Worker/frame/WebSocket/stream bypasses a form control | Every permitted channel is gated before transmission; explicitly block unsupported channels and test controlled receivers. |
|
|
| DLP-03 | Clipboard selection or destination changes during scan | Discard the pending release; scan approval cannot authorize a new selection, document or policy generation. |
|
|
| DLP-04 | ClickFix asks employee to execute copied instructions | Withhold covered dangerous command patterns; do not claim this heuristic detects all executable malware. |
|
|
| PARSE-01 | Document exploits native parser and reads user secrets | Native restricted-worker probe cannot read a synthetic private file outside explicitly approved roots. |
|
|
| PARSE-02 | Exploited parser sends document bytes to network | Native worker TCP/UDP probes fail without network capability; no loopback exemption or credential forwarding. |
|
|
| PARSE-03 | Worker forks, hangs, exhausts memory or survives owner | Process tree limits, no breakaway, deadline termination and clean subsequent scan; prove actual OS behavior. |
|
|
| POLICY-01 | Attacker replays old/expired/different-device policy | Signature, device binding, expiry and monotone revision reject it; emergency restore is published as a new version. |
|
|
| POLICY-02 | Operator forges admin permissions in session/UI | Backend recomputes role permissions; direct publication/revocation requests fail. |
|
|
| POLICY-03 | Cross-site page triggers an admin mutation | Exact Origin validation rejects cookie-authenticated writes and logout from other/missing origins. |
|
|
| AUTH-01 | Stolen/shared bootstrap token bypasses enterprise SSO | Remote HTTPS management rejects development bootstrap credentials. |
|
|
| AUTH-02 | Removed admin retains existing browser cookie | Explicit emergency session revocation rejects the next request; continuous IdP/back-channel revocation remains open. |
|
|
| PHISH-01 | Unknown domain renders a trusted login page | Pixel reference match plus exact HTTPS origin mismatch quarantines the page; validate layouts/languages/iframes and false positives before fleet-wide use. |
|
|
| AI-01 | Prompt injection asks agent/model to disclose other data | Policy and tool permissions are independent of prompt contents; retrieval ACLs and full tool governance remain open. |
|
|
| LOG-01 | Prompts, URLs with secrets or source documents enter logs | Allowlisted bounded metadata; inspect actual exported OTLP/ECS/CEF output and failure responses. |
|
|
| UPDATE-01 | Attacker supplies modified browser/model/update | Pinned artifact hashes and verified publisher signatures; production signed updater is still open. |
|
|
|
|
## Operational response and residual risks
|
|
|
|
Revoke compromised device credentials and management sessions; publish strengthened
|
|
rules as a new policy version and verify device acknowledgement. Preserve bounded
|
|
audit evidence under the customer's retention/access rules. Rotate affected keys
|
|
and provider credentials through deployment tooling; automated key rotation and
|
|
full incident workflow are not complete.
|
|
|
|
Unavailable scanners, unsupported content or expired policy must not be interpreted
|
|
as an allow verdict. Test recovery separately: a blocked parser request must not
|
|
force permanent loss of the scanner. Network/proxy/VPN detection has its documented
|
|
latency and cannot prove operating-system routing on its own.
|
|
|
|
Camera capture, manual retyping, other applications, administrator tampering,
|
|
unvalidated classifier accuracy and covert/encoded exfiltration remain residual
|
|
risks. Extend endpoint/network controls and independent bypass testing before
|
|
production approval. Each acceptance row needs evidence matching its full scope;
|
|
a green synthetic test for one path does not close all related paths.
|