Research workspace threat model

// Review cross-project access, shared-device sessions, export links and bulk imports in a research workspace, and who owns each control; ordinal scores and coverage are illustrative assumptions.
// Synthetic worked example: all entities, schedules and measurements are illustrative.
// Every string below is EXAMPLE text from a fictional model: replace it.
// Replace assumptions and inputs before applying this model to actual work.

threat_model assessment {
  title: "Illustrative Research workspace threat model"
  framework: "STRIDE"
  scope: "Design review; scores are illustrative ordinal judgements"
}

asset asset_0 {
  name: "Restricted research records"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

asset asset_1 {
  name: "Workspace memberships"
  value: "Protect confidentiality, integrity and availability"
  classification: "restricted"
}

threat r1 {
  title: "R1 · Cross-project record access"
  // Scenario: Authorisation missing on record lookup
  asset: asset_0
  category: "elevation"
  likelihood: 3
  impact: 4
}

control control_0 {
  title: "Scope every read and write by project membership"
  mitigates: [r1]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r2 {
  title: "R2 · Shared-device session misuse"
  // Scenario: An unattended session remains active
  asset: asset_1
  category: "spoofing"
  likelihood: 2
  impact: 5
}

control control_1 {
  title: "Offer explicit sign-out and session expiry"
  mitigates: [r2]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r3 {
  title: "R3 · Export link disclosure"
  // Scenario: Reusable export link reaches an unintended recipient
  asset: asset_0
  category: "info-disclosure"
  likelihood: 4
  impact: 3
}

control control_2 {
  title: "Use scoped expiring export grants"
  mitigates: [r3]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

threat r4 {
  title: "R4 · Bulk import exhaustion"
  // Scenario: Large imports monopolise workers
  asset: asset_1
  category: "dos"
  likelihood: 3
  impact: 2
}

control control_3 {
  title: "Bound import size and apply per-workspace queues"
  mitigates: [r4]
  type: "preventive"
  coverage: 0.6
  owner: "System owner; validate residual risk"
}

view risks: risk_matrix