[
https://issues.apache.org/jira/browse/HDDS-16800?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Siyao Meng updated HDDS-16800:
------------------------------
Fix Version/s: 2.3.0
Resolution: Done
Status: Resolved (was: Patch Available)
> Add availability to THREAT_MODEL.md
> -----------------------------------
>
> Key: HDDS-16800
> URL: https://issues.apache.org/jira/browse/HDDS-16800
> Project: Apache Ozone
> Issue Type: Improvement
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
> Labels: pull-request-available
> Fix For: 2.3.0
>
>
> THREAT_MODEL.md does not mention availability. Section 8 lists six security
> properties and none of them covers it, and section 9 does not disclaim it
> either. A report that a request stops a service therefore has no disposition
> in section 13, and a triager cannot tell whether it is VALID or BY-DESIGN.
> This adds the missing statement in both directions.
> What Ozone provides (section 8, new item 7): a small, fixed number of
> requests from an untrusted client or an authenticated non-admin user does not
> terminate or hang an Ozone service process, and does not leave the service
> unable to serve other users.
> What Ozone does not provide (section 9):
> * Withstanding load by volume, such as request floods and connection
> exhaustion. Limiting that is the operator's job.
> * Protection against a user consuming resources within the limits the
> operator granted.
> * Availability against admins or compromised service peers.
> Matching edits so the rest of the document agrees: the adversary list
> (section 7), operator guidance on quotas, FairCallQueue and rate limiting in
> front of S3 Gateway (section 10), known non-findings (section 11a), and the
> triage dispositions table (section 13).
> Documentation only.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
