STRIDE → IEC 62443 → ADRs

Threat model

24 threats, each mapped to the decisions and tests that cover it. Source: docs/THREAT-MODEL.md. Target security levels are assumptions still to be agreed with the customer.

4Spoofing

5Tampering

2Repudiation

6Information disclosure

4Denial of service

4Elevation of privilege

Components: the SONiC switch host (gate, border, Sidero Labs KMS server, NATS leaf), the Talos node, Core services (Git, SPIRE, NATS JetStream, HSM / root CA), the update volume and quarantine VM, the export volume, and OT devices.
IEC 62443 target security levels: SL 2 for the Edge and Core zones, SL 3 for the root of trust (offline root CA, HSM, Sidero Labs KMS server keys). Conduits: Edge → Core over NATS 7222 and Argo CD 443; the update and export volumes; the optional data diode.
STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege.

#	STRIDE	Threat	Mitigation	IEC 62443	Tests	Status
TM1	S	A rogue device plugs into an access port Switch host / port gate	ADR-004, 005, 030	FR1 identification and authentication / SL 2	T1–T4	mitigated
TM2	S	A cloned or forged node joins a cluster Talos node	ADR-005, 013, 021	FR1 / SL 2	T5, T26	mitigated
TM3	S	A stolen NATS credential is used from elsewhere NATS	ADR-024, 032	FR1 / SL 2	T30, T40	mitigated
TM4	T	A modified boot image or firmware Talos node	ADR-006, 028, 029	FR3 system integrity / SL 2	T6, T36, T37	mitigated
TM5	T	A tampered, old or replayed update volume Update path	ADR-015, 019, 027	FR3 / SL 2	T15, T25, T33	mitigated
TM6	T	A compromised switch host (the root of the site) Switch host	ADR-007, 016, 020, 021	FR3 / SL 2, SL 3 in prod	T8, T22, T26	partly mitigated; single point of failure accepted in POC
TM7	T	Physical tampering with the chassis Edge hardware	ADR-015 (tamper wipe)	FR3 / SL 2	T17	mitigated
TM8	T	Clock manipulation to defeat certificate or TUF expiry Time	ADR-022	FR3 / SL 2	T28	mitigated
TM9	R	An operator denies a key release, revocation or deployment Audit	ADR-025, 021, 032	FR6 timely response to events / SL 2	T27, T31, T40	mitigated
TM10	I	Customer A reads customer B's data NATS, SPIRE, network	ADR-002, 012, 024, 031	FR4 data confidentiality, FR5 restricted data flow / SL 2	T4, T10, T30	mitigated
TM11	I	Secrets leak from Git or an export volume Secrets, export	ADR-033, 015, 018	FR4 / SL 2	T16, T41	mitigated
TM12	I	Root CA or signing key compromise Core	ADR-018	FR4 / SL 3	T24	mitigated (HSM in prod)
TM13	D	WAN outage or long air gap stops the Edge Edge	ADR-013, 015, 023	FR7 resource availability / SL 2	T12, T21, T29	mitigated
TM14	D	Power loss mid-update, full disk, or a corrupt volume Edge	ADR-026, 034	FR7 / SL 2	T32, T42, T43	mitigated
TM15	D	Switch host failure takes the whole site down Switch host	ADR-020	FR7 / SL 2	–	accepted risk (POC), prod: redundant switch hosts
TM16	E	A workload escapes or moves sideways in a cluster Talos / Cilium	ADR-006 (Tetragon), 031	FR2 use control, FR5 / SL 2	T18, T39	mitigated
TM17	E	An OT asset reaches control services (Argo CD, Sidero Labs KMS server, SPIRE) Network	ADR-030, 014	FR5 / SL 2	T38	mitigated
TM18	E	Unexpected egress or an inbound connection to an Edge Border	ADR-012, 014	FR5 / SL 2	T11	mitigated
TM19	I	Encrypted export data or signatures broken later by quantum computers Export volumes, root CA	ADR-036	FR4 / SL 3	T45	planned (inventory in POC)
TM20	E	A single insider signs a malicious update or revokes a customer Signing, revocation	ADR-037	FR2 use control / SL 3	T46	mitigated
TM21	R	Control failures go unnoticed Monitoring	ADR-038, 025	FR6 / SL 2	T47	mitigated
TM22	D	A bad upgrade takes down Edges Platform	ADR-039, 034	FR7 / SL 2	T48	mitigated
TM23	I	Sensitive data leaves the Edge through the wrong channel Export, NATS	ADR-040, 027	FR4, FR5 / SL 2	T49	mitigated
TM24	I/S	A retired device leaks keys or rejoins Hardware lifecycle	ADR-041	FR1, FR4 / SL 2	T50	mitigated

"Mitigated" in the threat model means a mitigation is designed; see the test matrix for what has actually been proven in the lab.