7.2 KiB
7.2 KiB
DBIS AS4 Settlement Threat Model & Control Catalog
Date: 2026-01-19
Version: 1.0.0
1. Threat Model
1.1 Threat Categories
1.1.1 Replay Attacks
- Threat: Attacker replays valid messages
- Impact: Duplicate settlements, financial loss
- Likelihood: Medium
- Severity: High
1.1.2 Message Substitution
- Threat: Attacker modifies messages in transit
- Impact: Unauthorized settlements, fraud
- Likelihood: Low (with encryption)
- Severity: Critical
1.1.3 Key Compromise
- Threat: Private keys stolen or leaked
- Impact: Unauthorized message signing, fraud
- Likelihood: Low
- Severity: Critical
1.1.4 Insider Manipulation
- Threat: Authorized user performs unauthorized actions
- Impact: Fraud, data manipulation
- Likelihood: Low
- Severity: High
1.1.5 Endpoint Spoofing
- Threat: Attacker impersonates member endpoint
- Impact: Unauthorized access, fraud
- Likelihood: Medium
- Severity: High
1.1.6 Denial of Service
- Threat: Attacker floods system with requests
- Impact: Service unavailability
- Likelihood: Medium
- Severity: Medium
1.1.7 Man-in-the-Middle
- Threat: Attacker intercepts and modifies traffic
- Impact: Message tampering, fraud
- Likelihood: Low (with mTLS)
- Severity: Critical
2. Security Controls
2.1 Transport Security
2.1.1 Mutual TLS (mTLS)
- Control: Require mutual TLS for all AS4 connections
- Mitigates: Endpoint spoofing, man-in-the-middle
- Implementation: TLS 1.3, certificate pinning
- Status: Required
2.1.2 Certificate Pinning
- Control: Validate certificate fingerprints
- Mitigates: Certificate authority compromise
- Implementation: SHA-256 fingerprint matching
- Status: Required
2.1.3 TLS Configuration
- Control: Strong cipher suites, perfect forward secrecy
- Mitigates: Traffic decryption
- Implementation: TLS 1.3, restricted cipher suites
- Status: Required
2.2 Message Security
2.2.1 Message Signing
- Control: XMLDSig or JWS signatures on all messages
- Mitigates: Message substitution, tampering
- Implementation: RSA 2048 or ECDSA P-256
- Status: Required
2.2.2 Message Encryption
- Control: XML Encryption or JWE for sensitive data
- Mitigates: Message interception, data leakage
- Implementation: AES-256-GCM or ChaCha20-Poly1305
- Status: Required for sensitive messages
2.2.3 Non-Repudiation
- Control: Non-repudiation of origin and receipt (NRO/NRR)
- Mitigates: Dispute resolution, audit
- Implementation: AS4 receipts with signatures
- Status: Required
2.3 Anti-Replay Protection
2.3.1 Replay Nonce
- Control: Unique nonce per message
- Mitigates: Replay attacks
- Implementation: UUIDv7 or cryptographic nonce
- Status: Required
2.3.2 Time Window Validation
- Control: Reject messages outside time window
- Mitigates: Replay attacks
- Implementation: ±5 minute window
- Status: Required
2.3.3 Nonce Tracking
- Control: Track used nonces in Redis
- Mitigates: Replay attacks
- Implementation: Redis with TTL
- Status: Required
2.4 Key Management
2.4.1 HSM Integration
- Control: HSM-backed keys for signing
- Mitigates: Key compromise
- Implementation: Hardware security module
- Status: Required for production
2.4.2 Key Rotation
- Control: Regular key rotation
- Mitigates: Key compromise
- Implementation: 30-day rotation window
- Status: Required
2.4.3 Key Custody
- Control: Separation of duties, multi-person authorization
- Mitigates: Insider manipulation
- Implementation: Role-based access, approvals
- Status: Required
2.5 Access Control
2.5.1 Authentication
- Control: Strong authentication for all access
- Mitigates: Unauthorized access
- Implementation: mTLS, JWT tokens
- Status: Required
2.5.2 Authorization
- Control: Role-based access control (RBAC)
- Mitigates: Unauthorized actions
- Implementation: Policy engine, entitlements
- Status: Required
2.5.3 Audit Logging
- Control: Comprehensive audit trail
- Mitigates: Insider manipulation, disputes
- Implementation: Immutable WORM storage
- Status: Required
2.6 Network Security
2.6.1 Rate Limiting
- Control: Rate limits per member
- Mitigates: Denial of service
- Implementation: Gateway-level rate limiting
- Status: Required
2.6.2 DDoS Protection
- Control: DDoS mitigation at gateway
- Mitigates: Denial of service
- Implementation: CloudFlare or similar
- Status: Required
2.6.3 Network Segmentation
- Control: DMZ for gateway, internal network for core
- Mitigates: Lateral movement
- Implementation: Firewall rules, VLANs
- Status: Required
2.7 Application Security
2.7.1 Input Validation
- Control: Strict schema validation
- Mitigates: Injection attacks, malformed messages
- Implementation: JSON Schema, XML Schema
- Status: Required
2.7.2 Idempotency
- Control: Idempotent operations
- Mitigates: Duplicate processing
- Implementation: Instruction ID + Member ID key
- Status: Required
2.7.3 Error Handling
- Control: Secure error messages
- Mitigates: Information leakage
- Implementation: Generic error messages, detailed logs
- Status: Required
2.8 Monitoring and Detection
2.8.1 Security Monitoring
- Control: SIEM integration
- Mitigates: Attack detection
- Implementation: Centralized logging, alerting
- Status: Required
2.8.2 Anomaly Detection
- Control: Detect unusual patterns
- Mitigates: Fraud, attacks
- Implementation: ML-based anomaly detection
- Status: Recommended
2.8.3 Incident Response
- Control: Incident response procedures
- Mitigates: Attack impact
- Implementation: Runbooks, escalation
- Status: Required
3. Control Effectiveness Matrix
| Threat | Primary Control | Secondary Control | Effectiveness |
|---|---|---|---|
| Replay Attacks | Replay Nonce + Time Window | Nonce Tracking | High |
| Message Substitution | Message Signing | Message Encryption | High |
| Key Compromise | HSM Integration | Key Rotation | High |
| Insider Manipulation | RBAC + Audit Logging | Separation of Duties | Medium |
| Endpoint Spoofing | mTLS + Certificate Pinning | Directory Validation | High |
| Denial of Service | Rate Limiting | DDoS Protection | Medium |
| Man-in-the-Middle | mTLS + Certificate Pinning | Message Encryption | High |
4. Compliance Controls
4.1 Regulatory Compliance
- AML/CTF checks
- Sanctions screening
- KYC/KYB requirements
- Reporting obligations
4.2 Audit Requirements
- Immutable audit trail
- Evidence storage (WORM)
- Compliance package references
- Regulatory reporting
5. Residual Risks
5.1 Accepted Risks
- Low-probability, low-impact risks
- Risks with compensating controls
- Risks within risk appetite
5.2 Risk Mitigation
- Regular security assessments
- Penetration testing
- Security training
- Continuous improvement
End of Document