Siyao Meng created HDDS-16800:
---------------------------------
Summary: Add availability to THREAT_MODEL.md
Key: HDDS-16800
URL: https://issues.apache.org/jira/browse/HDDS-16800
Project: Apache Ozone
Issue Type: Improvement
Reporter: Siyao Meng
Assignee: Siyao Meng
THREAT_MODEL.md does not mention availability. Section 8 lists six security
properties and none of them covers it, and section 9 does not disclaim it
either. A report that a request stops a service therefore has no disposition in
section 13, and a triager cannot tell whether it is VALID or BY-DESIGN.
This adds the missing statement in both directions.
What Ozone provides (section 8, new item 7): a small, fixed number of requests
from an untrusted client or an authenticated non-admin user does not terminate
or hang an Ozone service process, and does not leave the service unable to
serve other users.
What Ozone does not provide (section 9):
* Withstanding load by volume, such as request floods and connection
exhaustion. Limiting that is the operator's job.
* Protection against a user consuming resources within the limits the operator
granted.
* Availability against admins or compromised service peers.
Matching edits so the rest of the document agrees: the adversary list (section
7), operator guidance on quotas, FairCallQueue and rate limiting in front of S3
Gateway (section 10), known non-findings (section 11a), and the triage
dispositions table (section 13).
Documentation only.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
