Field data collection threat model

// Review stolen devices, impersonated submissions, tampered offline records and sync overwrites in field data collection, and who owns each control; ordinal scores and coverage are illustrative assumptions.
// Synthetic worked example: all entities, schedules and measurements are illustrative.
// Every string below is EXAMPLE text from a fictional model: replace it.
// Replace assumptions and inputs before applying this model to actual work.

threat_model assessment {
  title: "Illustrative Field data collection threat model"
  framework: "STRIDE"
  scope: "Design review; scores are illustrative ordinal judgements"
}

asset asset_0 {
  name: "Device-held drafts"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

asset asset_1 {
  name: "Canonical submissions"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

threat r1 {
  title: "R1 · Stolen unlocked device"
  // Scenario: Drafts are available without device protection
  asset: asset_0
  category: "info-disclosure"
  likelihood: 3
  impact: 4
}

control control_0 {
  title: "Encrypt local storage and require device unlock"
  mitigates: [r1]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r2 {
  title: "R2 · Submission impersonation"
  // Scenario: Shared credentials obscure who submitted a record
  asset: asset_1
  category: "spoofing"
  likelihood: 2
  impact: 5
}

control control_1 {
  title: "Use individual identities and scoped sessions"
  mitigates: [r2]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r3 {
  title: "R3 · Tampered offline record"
  // Scenario: Local edits lose audit provenance
  asset: asset_0
  category: "tampering"
  likelihood: 4
  impact: 3
}

control control_2 {
  title: "Preserve record versions and audit transitions"
  mitigates: [r3]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r4 {
  title: "R4 · Sync conflict overwrite"
  // Scenario: Last write silently removes evidence
  asset: asset_1
  category: "tampering"
  likelihood: 3
  impact: 2
}

control control_3 {
  title: "Detect version conflicts and require resolution"
  mitigates: [r4]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

view risks: risk_matrix