THREAT_MODEL.md

<p align="center">
  <img src="https://hack23.com/icon-192.png" alt="Hack23 Logo" width="192" height="192">
</p>

<h1 align="center">🎯 Hack23 AB — Riksdagsmonitor Threat Model</h1>

<p align="center">
  <strong>🛡️ Proactive Security Through Structured Threat Analysis</strong><br>
  <em>🔍 STRIDE • MITRE ATT&CK • Static Website • AI-Powered News • Democratic Transparency</em>
</p>

<p align="center">
  <a href="#"><img src="https://img.shields.io/badge/Owner-CEO-0A66C2?style=for-the-badge" alt="Owner"/></a>
  <a href="#"><img src="https://img.shields.io/badge/Version-1.2-555?style=for-the-badge" alt="Version"/></a>
  <a href="#"><img src="https://img.shields.io/badge/Effective-2026--04--20-success?style=for-the-badge" alt="Effective Date"/></a>
  <a href="#"><img src="https://img.shields.io/badge/Review-Quarterly-orange?style=for-the-badge" alt="Review Cycle"/></a>
</p>

**📋 Document Owner:** CEO | **📄 Version:** 1.2 | **📅 Last Updated:** 2026-04-20 (UTC)  
**🔄 Review Cycle:** Quarterly | **⏰ Next Review:** 2026-07-20  
**🏢 Owner:** Hack23 AB (Org.nr 5595347807) | **🏷️ Classification:** Public

> **🆕 What changed since last review (v1.1 → v1.2, 2026-04-20):**
> - 📈 **IMF elevated to a primary external economic data source** (parity with SCB and World Bank) per [ADR 0001](docs/adr/0001-adopt-imf-data-alongside-world-bank.md). Existing row **TB-6a** covers the `imf-ts-client` data flow in detail; this revision additionally: (a) adds IMF to the **Critical Assets** inventory under "Parliamentary Data / Economic Context", (b) notes two IMF-specific residual risks — **projection-vintage confusion** (WEO vintage drift: an old WEO dataset cited as current; mitigated by `projectionVintage` sidecar + Economic Data Contract v2.0 field) and **cache poisoning of `analysis/data/imf/`** (mitigated by `.meta.json` integrity sidecars, SBOM-covered schema validation, and Git-tracked diffs under PR review), and (c) adds an **"IMF upstream / transport adversary"** row to the Threat Agent Classification Framework (low likelihood; controls already enumerated in TB-6a).
>
> **🆕 What changed since last review (v1.0 → v1.1, 2026-04-20):**
> - Full **STRIDE pass** re-executed over the current architecture of Riksdagsmonitor `v0.8.48`:
>   - **Spoofing:** GitHub OIDC federation to AWS (no long-lived keys); npm provenance attestations; MCP server TLS + token-scoped auth.
>   - **Tampering:** SRI on all static assets via `vite-plugin-sri-gen@1.3.2`; Git signed commits; immutable S3 object versioning + CloudFront origin signing; schema-validated CIA data ingestion (`validate-against-cia-schemas`); translation integrity via `validate-translations`.
>   - **Repudiation:** GitHub audit log + CloudTrail; signed releases; SLSA L3 provenance on npm; Actions run logs retained.
>   - **Information Disclosure:** Public classification by design, but secrets scanning, CodeQL, Dependabot alerts, and `step-security/harden-runner` guard against accidental exfiltration from build runners.
>   - **Denial of Service:** CloudFront absorbs L3/L7 volumetrics; WAF rate-limiting; dual-region failover; GitHub Pages DR tier; npm package remains available independently of web tier.
>   - **Elevation of Privilege:** Least-privilege `permissions:` on every workflow; PR-gated merges; five-layer safe-output validation for agentic workflows; reviewer approval for every agentic-generated PR.
> - **New threat category — Agentic / LLM-specific:**
>   - Prompt injection via upstream political-content sources → mitigated by MCP-side input sanitisation, system-prompt hardening, and safe-outputs schema validation.
>   - Tool-call exfiltration attempts → mitigated by Squid proxy + iptables egress allow-list.
>   - Model-generated misinformation → mitigated by human-review gate (layer 4 of safe-outputs), source citation enforcement, and the AI FIRST quality principle.
>   - Covered by [OWASP LLM Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md) and [AI_Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md).
> - **New threat category — Supply-chain on MCP servers:** SBOM checks for `@jarib/pxweb-mcp`, `worldbank-mcp`, and the hosted `riksdag-regering` endpoint; version pinning; OpenSSF Scorecard on dependencies where available.
> - **Data poisoning on CIA upstream repo:** schema validation + diff review gates on every `update-cia-csv-data.yml` auto-PR.
> - MITRE ATT&CK references integrated: T1195 (Supply Chain Compromise), T1566 (Phishing — N/A no users), T1078 (Valid Accounts — OIDC-only mitigates), T1486 (Data Encrypted for Impact — immutable backups mitigate), plus ATLAS AML.T0051 (LLM Prompt Injection) and AML.T0053 (LLM Plugin Compromise).
> - Compliance mapping: ISO 27001:2022 Annex A.5.7/A.8.8/A.8.28, NIST CSF 2.0 ID.RA/DE.AE/RS.AN, CIS Controls v8.1 #16/#18, NIS2 Art. 21, EU CRA Annex I §(3).

---

## 🎯 Purpose & Scope

Establish a comprehensive threat model for **Riksdagsmonitor**, a democratic transparency platform monitoring Swedish Parliament (Riksdag) and Government (Regeringen) activity. This systematic threat analysis integrates multiple frameworks—STRIDE, MITRE ATT&CK, Attack Trees, and OWASP LLM Top 10—to ensure proactive security through structured analysis of the static website infrastructure with interactive Chart.js/D3.js dashboards and AI-powered content generation workflows.

### **🌟 Transparency Commitment**

This threat model demonstrates **🛡️ cybersecurity consulting expertise** through public documentation of advanced threat assessment methodologies for civic transparency platforms, showcasing our **🏆 competitive advantage** via systematic risk management and **🤝 customer trust** through transparent security practices.

> *"At Hack23, we believe that true security comes through transparency and demonstrable practices. This threat model is publicly available to showcase our proactive security posture, allowing clients and stakeholders to verify our commitment to security excellence. By openly documenting our threat analysis for Riksdagsmonitor, we demonstrate not just what we protect, but how we protect it—reinforcing democratic accountability through secure civic technology."*
>
> *— James Pether Sörling, CEO & CISO, Hack23 AB*

### **📚 Framework Integration**

- **🎭 STRIDE per element:** Systematic threat categorization for static hosting, CDN, dashboards, and AI workflows
- **🎖️ MITRE ATT&CK mapping:** Infrastructure and supply chain attack techniques
- **🏗️ Asset-centric analysis:** Democratic transparency data and Swedish Parliament content protection
- **🎯 Scenario-centric modeling:** Real-world attack simulation for civic platforms with AI content generation
- **⚖️ Risk-centric assessment:** Business impact quantification and democratic accountability
- **🤖 OWASP LLM Top 10:** AI/LLM-specific threat assessment for agentic news generation

### **🔍 Scope Definition**

**Included Systems:**

- 🌐 Static HTML/CSS website (14-language support: Swedish, English, Danish, Norwegian, Finnish, German, French, Spanish, Dutch, Arabic, Hebrew, Japanese, Korean, Chinese)
- 📊 Chart.js/D3.js interactive dashboards (4 functional: Overview, Party Performance, Ministry Activity, Legislative Timeline; 5 placeholders)
- ☁️ AWS CloudFront CDN + S3 storage (us-east-1 primary, eu-west-1 replica)
- 🔀 Route 53 DNS configuration with health checks
- 🔄 GitHub Pages disaster recovery (automatic failover)
- 🤖 11 AI agentic workflows using Claude Opus 4.7 (10 single-run news + 1 translate); each runs **analysis → aggregate → render → PR** in one shot. Examples:
  - **news-evening-analysis**: 18:00 UTC Mon-Fri, 16:00 UTC Sat
  - **news-realtime-monitor**: 10:00+14:00 UTC Mon-Fri, 12:00 UTC weekends
  - **news-translate**: out-of-band fan-out from rendered EN+SV to 12 other languages
- 🔌 riksdag-regering-mcp server (32 tools for Swedish political data)
- 🏭 CI/CD security pipeline (GitHub Actions with OIDC)
- 📦 Dependency management and supply chain (Chart.js, D3.js, Vite, npm, GitHub Actions)

**Out of Scope:**

- Backend services (none exist—frontend-only architecture)
- User data persistence (public read-only platform, no user accounts)
- CIA platform backend security (external data source)
- Third-party CDN infrastructure security (jsDelivr for Chart.js/D3.js)
- End-user device security beyond browser environment
- Anthropic Claude API internal security (vendor responsibility)

### **🔗 Policy Alignment**

Integrated with [🎯 Hack23 AB Threat Modeling Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md) methodology, following the five-strategy integrated approach:
1. **Attacker-centric** (MITRE ATT&CK)
2. **Asset-centric** (Crown Jewels)
3. **Architecture-centric** (STRIDE per element)
4. **Scenario-centric** (Misuse cases)
5. **Risk-centric** (Quantitative assessment)

Additionally aligned with [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) for LLM application security.

### **📊 Executive Summary**

This threat model systematically analyzes security for Riksdagsmonitor using thematic Hack23 structure, identifies 52 threats across 6 STRIDE categories + 18 AI-specific threats (OWASP LLM Top 10), and documents comprehensive mitigations aligned with Hack23 AB's ISMS.

**Key Findings:**
- **Critical-Risk Threats:** 0 (All critical threats mitigated)
- **High-Risk Threats:** 2 (Enhanced monitoring + Q1 2026 remediation)
- **Medium-Risk Threats:** 8 (Controls in place, continuous monitoring)
- **Low-Risk Threats:** 42 (Accepted with controls)
- **AI-Specific Threats:** 18 (OWASP LLM Top 10 coverage)
- **Attack Trees:** 9 attack trees (3 dedicated + 6 embedded scenarios)
- **MITRE ATT&CK Techniques:** 23 mapped
- **Residual Risk:** LOW (3.2/10.0) - Acceptable for public civic transparency platform

**Highest Priority Threats:**
1. **AI-H1 (LLM09 Overreliance):** Hallucinated parliamentary data - Risk Score 3.2/10
2. **T1 (Tampering):** Repository content tampering - Risk Score 2.4/10
3. **AI-P1 (LLM01 Prompt Injection):** Indirect prompt injection - Risk Score 2.8/10

---

## 📚 Architecture Documentation Map

| Document | Description | Status | Relevance to Threat Model |
|----------|-------------|--------|--------------------------|
| **🎯 THREAT_MODEL.md** ← **(this document)** | STRIDE, ATT&CK, Attack Trees, Crown Jewels, Risk Analysis | ✅ Current | Primary document |
| [🏛️ ARCHITECTURE.md](./ARCHITECTURE.md) | C4 Context/Container/Component models | ✅ Current | System boundaries, trust zones |
| [🔐 SECURITY_ARCHITECTURE.md](./SECURITY_ARCHITECTURE.md) | Security controls implementation (CSP, SRI, IAM) | ✅ Current | Control effectiveness mapping |
| [🔮 FUTURE_SECURITY_ARCHITECTURE.md](./FUTURE_SECURITY_ARCHITECTURE.md) | Planned security improvements | ✅ Current | Roadmap for gap closure |
| [📊 DATA_MODEL.md](./DATA_MODEL.md) | Political data entities and relationships | ✅ Current | Data integrity requirements |
| [🔄 FLOWCHART.md](./FLOWCHART.md) | Business process and data flows | ✅ Current | Attack surface identification |
| [📈 STATEDIAGRAM.md](./STATEDIAGRAM.md) | System state transitions and lifecycles | ✅ Current | State-based threat scenarios |
| [🧠 MINDMAP.md](./MINDMAP.md) | System conceptual relationships | ✅ Current | Asset dependency mapping |
| [💼 SWOT.md](./SWOT.md) | Strategic analysis and positioning | ✅ Current | Threat opportunity alignment |
| [🏗️ FUTURE_ARCHITECTURE.md](./FUTURE_ARCHITECTURE.md) | Architectural evolution roadmap | ✅ Current | Future attack surface changes |
| [📊 FUTURE_DATA_MODEL.md](./FUTURE_DATA_MODEL.md) | Enhanced data architecture plans | ✅ Current | Future data integrity risks |
| [🔄 FUTURE_FLOWCHART.md](./FUTURE_FLOWCHART.md) | Improved process workflows | ✅ Current | Future DFD/STRIDE analysis |
| [📈 FUTURE_STATEDIAGRAM.md](./FUTURE_STATEDIAGRAM.md) | Advanced state management | ✅ Current | Future state threat scenarios |
| [🧠 FUTURE_MINDMAP.md](./FUTURE_MINDMAP.md) | Capability expansion plans | ✅ Current | Future asset identification |
| [💼 FUTURE_SWOT.md](./FUTURE_SWOT.md) | Future strategic opportunities | ✅ Current | Strategic risk forecasting |
| [🔧 WORKFLOWS.md](./WORKFLOWS.md) | CI/CD automation and pipelines | ✅ Current | Pipeline security analysis |
| [🛡️ CRA-ASSESSMENT.md](./CRA-ASSESSMENT.md) | EU Cyber Resilience Act conformity | ✅ Current | CRA compliance evidence |

---

## 📊 System Classification & Operating Profile

### **🏷️ Security Classification Matrix**

| Dimension | Level | Rationale | Business Impact |
|----------|-------|-----------|----------------|
| **🔐 Confidentiality** | [![Public](https://img.shields.io/badge/C-Public-lightgrey?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#confidentiality-levels) | All content intentionally disclosed (Swedish Riksdag open data, AI-generated news, website content) | [![Trust Enhancement](https://img.shields.io/badge/Value-Trust_Enhancement-darkgreen?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) |
| **🔒 Integrity** | [![High](https://img.shields.io/badge/I-High-orange?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#integrity-levels) | Automated validation, digital signatures (Git/GPG commits), accurate political data required, AI output verification | [![Operational Excellence](https://img.shields.io/badge/Value-Operational_Excellence-blue?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) |
| **⚡ Availability** | [![High](https://img.shields.io/badge/A-High-orange?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#availability-levels) | 99.998% design availability target (AWS CloudFront 99.9% SLA), automated multi-region failover, GitHub Pages DR | [![Revenue Protection](https://img.shields.io/badge/Value-Revenue_Protection-red?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) |

**Overall Security Classification:** **PUBLIC / HIGH / HIGH** (C/I/A)

### **⚖️ Regulatory & Compliance Profile**

| Compliance Area | Classification | Implementation Status |
|-----------------|----------------|----------------------|
| **📋 Regulatory Exposure** | Low | Public information dissemination only; GDPR applies for public-official data processing (public interest/legitimate interest grounds per GDPR Art. 6(1)(e)) |
| **🇪🇺 CRA (EU Cyber Resilience Act)** | Standard | Non-commercial OSS civic transparency platform; self-assessment approach per Recital 18 |
| **🤖 EU AI Act** | Limited Risk (Article 52) | Transparency obligations (AI-generated content disclosure), human oversight required, no high-risk use cases |
| **📊 GDPR Data Processing** | Public Officials Only | Personal data (names, roles, voting records, intressent_id) from Swedish Riksdag open data; no special-category data (Art. 9) or private individuals |
| **🔄 RPO / RTO** | RPO: 4-24h / RTO: 1-4h | Daily data pipeline updates, Git version control, S3 versioning; automated multi-region failover |

### **💰 Business Impact Analysis**

| Impact Category | Level | Description | Annual Cost Avoidance |
|-----------------|-------|-------------|----------------------|
| **Financial** | [![Low](https://img.shields.io/badge/Low-lightgreen?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#financial-impact-levels) | Minimal financial impact (<$500 daily) - Open-source project, no revenue dependency | $0 |
| **Operational** | [![Moderate](https://img.shields.io/badge/Moderate-yellow?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#operational-impact-levels) | Partial service impact - Swedish political transparency temporarily unavailable | $2,400/year |
| **Reputational** | [![High](https://img.shields.io/badge/High-orange?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#reputational-impact-levels) | Industry-wide attention - Transparency advocates, media, civil society notice outages or misinformation | $50,000/year |
| **Regulatory** | [![Low](https://img.shields.io/badge/Low-lightgreen?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#regulatory-impact-levels) | No regulatory fines - Public information dissemination only, GDPR legitimate interest applies | $0 |

**Total Annual Cost Avoidance Through Security Controls:** **$52,400**

### **🌍 Operating Environment**

| Characteristic | Value | Security Implications |
|---------------|-------|----------------------|
| **Geographic Reach** | Global (14 languages) | Multi-region CDN required, translation integrity critical |
| **User Base** | Public (unlimited) | No authentication, DDoS resilience required |
| **Data Volume** | ~150 MB static content + 500MB political data (CSV) | S3 versioning, CDN caching, bandwidth management |
| **Update Frequency** | Daily (data pipeline) + Real-time (news workflows) | CI/CD security critical, rollback procedures essential |
| **Availability Target** | 99.998% (5.2 minutes/month downtime) | Multi-region architecture, health checks, DR failover |
| **Peak Traffic** | Swedish election periods (4x normal) | AWS CloudFront auto-scaling, GitHub Pages DR capacity |

---

## �� Critical Assets & Protection Goals

### **🏗️ Asset-Centric Threat Analysis**

Following [Hack23 AB Asset-Centric Threat Modeling](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#asset-centric-threat-modeling) methodology, we identify "Crown Jewels" requiring highest protection:

| Asset Category | Why Valuable (Crown Jewel Rationale) | Primary Threats | Key Controls | Business Value | Annual Cost Avoidance |
|----------------|--------------------------------------|-----------------|-------------|----------------|----------------------|
| **📊 Dashboard Integrity** | Political data accuracy drives user trust; manipulation undermines democratic transparency mission | Content manipulation, XSS injection, data tampering | CSP headers, SRI hashes, Git immutability, dual deployment (AWS+GitHub) | [![Trust Enhancement](https://img.shields.io/badge/Value-Trust_Enhancement-darkgreen?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $30,000 |
| **🗳️ Parliamentary Data** | Swedish Riksdag voting records, committee reports, parliamentary documents—core mission asset | Data falsification, integrity compromise, hallucination | CIA platform validation, riksdag-regering-mcp verification, daily pipeline updates, version control | [![Competitive Advantage](https://img.shields.io/badge/Value-Competitive_Advantage-gold?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $40,000 |
| **📈 External Economic Context (SCB + World Bank + IMF)** | Three-source economic data foundation for policy analysis and news enrichment: SCB MCP (official Swedish statistics), World Bank MCP (governance/environment/long-horizon social), **IMF pure-TS client** (WEO/Fiscal Monitor/IFS + T+5 projections) | Upstream outage, DNS/TLS MITM, stale WEO vintage, cache poisoning of `analysis/data/imf/`, rate-limit saturation | Egress allowlist (scb.se, worldbank.org, data.imf.org, api.imf.org, www.imf.org); `DatamapperResponse` schema validation in `scripts/imf-client.ts`; `.meta.json` tamper-evident sidecars recording `projectionVintage`; graceful fallback (optional-enrichment semantics); npm SBOM coverage (no external MCP package) — see **TB-6a** | [![Innovation Enablement](https://img.shields.io/badge/Value-Innovation_Enablement-lightblue?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $10,000 |
| **🧠 Source Code & Algorithms** | Dashboard visualization logic, Chart.js/D3.js integrations, AI workflow orchestration | IP theft, malicious injection, supply chain attacks | Private repo access controls, dependency scanning (Dependabot + CodeQL), GPG commit signing | [![Operational Excellence](https://img.shields.io/badge/Value-Operational_Excellence-blue?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $15,000 |
| **🌐 Riksdagsmonitor Brand** | Market reputation, stakeholder trust, search engine positioning | Domain hijacking, phishing, brand impersonation, SEO poisoning | Domain monitoring, HTTPS enforcement, DNSSEC, HSTS preload, trademark registration | [![Risk Reduction](https://img.shields.io/badge/Value-Risk_Reduction-green?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $20,000 |
| **☁️ Infrastructure Config** | AWS CloudFront, S3, Route 53 security baseline; GitHub Actions secrets | Infrastructure compromise, misconfiguration, credential exposure | IAM least privilege, OIDC (no long-lived keys), AWS Config rules, secret scanning | [![Security Excellence](https://img.shields.io/badge/Value-Security_Excellence-purple?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $25,000 |
| **🤖 AI News Content** | Automated journalism credibility; trusted source for Swedish political analysis | Prompt injection, hallucination, bias, misinformation | Claude Opus 4.7 with Anthropic guardrails, riksdag-regering-mcp validation, mandatory PR review, fact-checking protocol | [![Innovation Enablement](https://img.shields.io/badge/Value-Innovation_Enablement-lightblue?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) | $50,000 |

**Total Asset Value (Annual Cost Avoidance):** **$180,000**

### **🔐 Crown Jewel Analysis**

Crown Jewels are the top 5 highest-value assets that adversaries most desire and whose compromise would cause the greatest harm to Riksdagsmonitor's democratic transparency mission.

| Crown Jewel Rank | Asset | Crown Jewel Rationale | Attack Attractiveness | Compromise Impact | Protection Priority |
|-----------------|-------|----------------------|----------------------|-------------------|---------------------|
| **👑 #1** | 🗳️ **Election Data Integrity** | Accuracy of election predictions, seat forecasts, and voting record aggregation from CIA platform; any manipulation directly undermines democratic accountability | **VERY HIGH** — Nation-state actors, political adversaries, election interference campaigns | Catastrophic: Misinformation affects public understanding of Swedish democratic processes, potential election influence | **CRITICAL — Multiple overlapping controls** |
| **👑 #2** | 📊 **Dashboard Data Accuracy** | CIA platform data pipeline integrity and Chart.js/D3.js visualizations; primary channel for political transparency; 14-language real-time display | **HIGH** — Data accuracy is core mission; CSP/SRI protect against XSS/CDN tampering | High: Corrupted dashboards erode public trust, could misrepresent party standings or vote outcomes | **HIGH — SRI hashes, CSP, dual-region** |
| **👑 #3** | 🌍 **Multi-Language Content** | 14-language factual consistency (SV, EN, DA, NO, FI, DE, FR, ES, NL, AR, HE, JA, KO, ZH); translation divergence enables targeted disinformation campaigns in specific languages | **HIGH** — RTL (Arabic/Hebrew) harder to validate; targeted manipulation of specific language communities | High: Language-specific manipulation could spread unchecked; undermines trust of multilingual audience | **HIGH — TRANSLATION_GUIDE.md, Playwright RTL testing** |
| **👑 #4** | 🔑 **CI/CD Pipeline Security** | GitHub Actions OIDC, supply chain integrity, SHA-pinned actions, SLSA attestations; compromise enables persistent content injection with no trust boundary to stop it | **HIGH** — Supply chain attacks (SolarWinds-pattern) increasingly common against civic platforms | Catastrophic: Persistent backdoor in CI/CD bypasses all publication controls; could inject malicious HTML into all pages | **CRITICAL — OIDC, SHA-pinning, branch protection** |
| **👑 #5** | 📰 **News Article Credibility** | AI-generated (Claude Opus 4.7) daily political news accuracy; journalistic credibility for Swedish parliamentary and government activity reporting | **MEDIUM-HIGH** — Prompt injection, hallucination; AI-generated political misinformation campaigns | High: Fabricated parliamentary data damages reputation, could be amplified by external media; EU AI Act liability | **HIGH — Mandatory PR review, dok_id validation** |

**Crown Jewel Protection Strategy:**
- 🔐 **Defense-in-Depth:** Every Crown Jewel has ≥3 overlapping controls (no single point of failure)
- 🎯 **Zero-Tolerance Policy:** Crown Jewels #1 and #4 have CRITICAL integrity requirements — any detected compromise triggers immediate incident response
- 🔍 **Enhanced Monitoring:** Crown Jewels receive continuous automated monitoring plus human spot-checks
- 📋 **Quarterly Review:** Crown Jewel list reviewed quarterly and after any significant architectural change

| Asset | Confidentiality Goal | Integrity Goal | Availability Goal |
|-------|---------------------|----------------|-------------------|
| **Dashboard Code** | Public (open source) | **HIGH** - No unauthorized modifications | **HIGH** - 99.95% uptime |
| **Political Data** | Public (Swedish law) | **CRITICAL** - 100% accuracy required | **HIGH** - Daily updates essential |
| **Infrastructure** | Internal (AWS configs) | **HIGH** - Prevent misconfiguration | **CRITICAL** - 99.998% target |
| **AI Content** | Public (after review) | **CRITICAL** - Zero hallucinations published | **MEDIUM** - Graceful degradation OK |
| **Brand Assets** | Public (marketing) | **HIGH** - Authentic representation | **MEDIUM** - Backup channels exist |

### **📋 Asset Inventory**

Complete asset inventory with classifications:

| Asset ID | Asset Name | Type | Classification (C/I/A) | Value | Owner | Location |
|----------|-----------|------|----------------------|-------|-------|----------|
| **ASSET-001** | Riksdagsmonitor Website | Application | PUBLIC/HIGH/HIGH | CRITICAL | CEO | GitHub Pages + AWS CloudFront |
| **ASSET-002** | Dashboard JavaScript (Chart.js/D3.js) | Application | PUBLIC/HIGH/HIGH | HIGH | CEO | GitHub Repository |
| **ASSET-003** | Political Data (CSV) | Data | PUBLIC/HIGH/HIGH | CRITICAL | CEO | S3 buckets (us-east-1, eu-west-1) |
| **ASSET-004** | GitHub Repository | Infrastructure | PUBLIC/HIGH/CRITICAL | HIGH | CEO | GitHub.com |
| **ASSET-005** | AWS Infrastructure (S3, CloudFront, Route 53) | Infrastructure | INTERNAL/HIGH/CRITICAL | HIGH | CEO | AWS (us-east-1, eu-west-1) |
| **ASSET-006** | GitHub Actions Secrets (AWS OIDC) | Credentials | CONFIDENTIAL/CRITICAL/HIGH | CRITICAL | CEO | GitHub Secrets |
| **ASSET-007** | AI Workflows (Claude Opus 4.7) | Application | PUBLIC/HIGH/MEDIUM | HIGH | CEO | GitHub Actions |
| **ASSET-008** | riksdag-regering-mcp Server | Integration | PUBLIC/HIGH/HIGH | HIGH | CEO | Render.com |
| **ASSET-009** | Domain Name (riksdagsmonitor.com) | Infrastructure | PUBLIC/HIGH/CRITICAL | CRITICAL | CEO | Route 53 |
| **ASSET-010** | Brand & Reputation | Intangible | PUBLIC/HIGH/MEDIUM | HIGH | CEO | N/A |

---

## 🌐 Data Flow & Architecture Analysis

This section integrates **STRIDE per element** analysis into architecture diagrams, following [Hack23 Threat Modeling Policy § 4.3](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#architecture-centric-stride-per-element) methodology.

### **🏗️ System Context Diagram (C4 Level 1)**

```mermaid
graph TB
    subgraph External["🔴 Untrusted Zone - Internet"]
        User[🌍 End Users<br/>Global Audience<br/>14 Languages]
        Attacker[💀 Threat Actors<br/>Nation-state APTs<br/>Cybercriminals<br/>Hacktivists]
    end
    
    subgraph Edge["🟠 Edge Security Zone - CDN Layer"]
        CloudFront[☁️ AWS CloudFront<br/>Primary CDN<br/>99.9% SLA]
        GitHubPages[🔄 GitHub Pages<br/>DR Fallback<br/>Automatic Failover]
    end
    
    subgraph Internal["🟢 Trusted Zone - Hack23 Control"]
        Repo[📦 GitHub Repository<br/>Source Code<br/>GPG Signed Commits]
        Actions[⚙️ GitHub Actions<br/>CI/CD Pipeline<br/>OIDC Auth]
        S3[💾 S3 Buckets<br/>Static Content<br/>Cross-Region Replication]
    end
    
    subgraph External2["🔴 External Data Sources"]
        MCP[🔌 riksdag-regering-mcp<br/>32 Political Tools<br/>Render.com]
        Claude[🤖 Claude Opus 4.7<br/>AI Content Generation<br/>GitHub Copilot API]
        RiksdagAPI[🏛️ data.riksdagen.se<br/>Swedish Parliament Open Data]
    end
    
    User -->|HTTPS TLS 1.3| CloudFront
    User -->|HTTPS Failover| GitHubPages
    Attacker -.->|Attack Vectors| User
    Attacker -.->|DDoS/Injection| CloudFront
    
    CloudFront -->|Serves Content| S3
    GitHubPages -->|Serves Content| Repo
    
    Actions -->|Deploy OIDC| S3
    Actions -->|Deploy| Repo
    Actions -->|Call API| Claude
    Actions -->|Query Data| MCP
    
    MCP -->|Fetch Data| RiksdagAPI
    
    style User fill:#90caf9,color:#000
    style Attacker fill:#f44336,color:#fff
    style CloudFront fill:#ff9800,color:#000
    style GitHubPages fill:#ff9800,color:#000
    style Repo fill:#4caf50,color:#000
    style Actions fill:#4caf50,color:#000
    style S3 fill:#4caf50,color:#000
    style MCP fill:#9c27b0,color:#fff
    style Claude fill:#9c27b0,color:#fff
    style RiksdagAPI fill:#9c27b0,color:#fff
```

### **🔒 Trust Boundaries & STRIDE Analysis**

| Trust Boundary | Crossing Point | STRIDE Threats | Key Controls |
|---------------|----------------|----------------|-------------|
| **TB-1: Internet → CloudFront** | User HTTPS requests | **S**: Domain spoofing, **T**: MITM, **D**: DDoS | TLS 1.3, HSTS, AWS Shield, Domain monitoring |
| **TB-2: Internet → GitHub Pages** | DR failover requests | **S**: Phishing sites, **T**: Content injection, **D**: GitHub outage | HTTPS, Branch protection, GitHub SLA |
| **TB-3: CloudFront → S3** | Internal AWS communication | **I**: Unauthorized access, **E**: IAM escalation | OIDC, Least privilege IAM, S3 bucket policy |
| **TB-4: GitHub Actions → AWS** | OIDC deployment | **I**: Secret exposure, **E**: Privilege escalation | OIDC (no long-lived keys), CloudTrail monitoring |
| **TB-5: GitHub Actions → Claude API** | AI content generation | **T**: Prompt injection, **I**: Hallucination, **R**: Non-determinism | Input sanitization, output validation, PR review |
| **TB-6: GitHub Actions → MCP** | Political data queries | **S**: Server impersonation, **T**: Data manipulation, **I**: Stale data | HTTPS-only, Freshness validation, Cross-verification |
| **TB-6a: Agentic workflows → IMF (TypeScript client, no MCP)** | Macro/fiscal/monetary queries to `data.imf.org` / `api.imf.org` / `www.imf.org` issued directly from `scripts/imf-client.ts` and the `scripts/imf-fetch.ts` CLI (invoked by agentic workflows through the `bash` tool). No Python/`uvx` runtime; client is npm-only. | **S**: IMF origin DNS hijack or TLS MITM on workflow egress; **T**: Tampering of IMF JSON responses in transit or at rest under `analysis/data/imf/`; **I**: Stale / mis-vintaged WEO projections cited as current values; **D**: IMF rate-limit (~10 req / 5 s) causing workflow failure | HTTPS / TLS 1.3 with GitHub-runner root-CA trust store; firewall allowlist scoped to `data.imf.org` / `api.imf.org` / `www.imf.org` only; response schema validation in `imf-client.ts` (`DatamapperResponse` shape, numeric finite-check, year parse-guard); cached responses under `analysis/data/imf/{indicator}/{country}.json` with sidecar `.meta.json` stamping `mcpTool: imf-ts-client` + `projectionVintage`; built-in 3× 429 back-off (1 s → 2 s → 4 s) plus `compare` subcommand batching multi-country in one Datamapper call; no additional third-party code paths (client is part of the npm SBOM) |
| **TB-7: Browser → CDN (Chart.js/D3.js)** | External library loading | **T**: Supply chain attack, **I**: XSS injection | SRI hashes, CSP, Trusted CDN (jsDelivr) |

### **📊 Container Diagram (C4 Level 2) - Detailed Architecture**

```mermaid
graph TB
    subgraph "🌐 Presentation Layer"
        HTML[📄 Static HTML<br/>14 Languages<br/>Responsive Design]
        CSS[🎨 CSS Styles<br/>Cyberpunk Theme<br/>RTL Support]
        Dashboard[📊 Dashboards<br/>Chart.js + D3.js<br/>4 Functional, 5 Placeholders]
    end
    
    subgraph "⚙️ CI/CD Layer"
        Workflow1[🗞️ news single-run workflows<br/>10 per-type pipelines<br/>analysis→aggregate→render→PR<br/>Claude Opus 4.7]
        Workflow2[🌆 news-evening-analysis<br/>18:00 UTC Mon-Fri<br/>16:00 UTC Sat]
        Workflow3[⚡ news-realtime-monitor<br/>10:00+14:00 UTC Mon-Fri<br/>12:00 UTC weekends]
        Workflow4[🌍 news-translate<br/>Out-of-band<br/>EN+SV → 12 languages]
        Deploy[🚀 Deployment Workflow<br/>Vite Build<br/>AWS OIDC Deploy]
    end
    
    subgraph "☁️ Infrastructure Layer"
        CDN[☁️ CloudFront Distribution<br/>Global Edge Locations<br/>AWS Shield Standard]
        S3Primary[💾 S3 Primary<br/>us-east-1<br/>Versioning Enabled]
        S3Replica[💾 S3 Replica<br/>eu-west-1<br/>Cross-Region Replication]
        DNS[🔀 Route 53<br/>Health Checks<br/>Automatic Failover]
        GHPages[🔄 GitHub Pages<br/>DR Site<br/>*.github.io]
    end
    
    subgraph "🔌 External Services"
        MCP[🔌 MCP Server<br/>riksdag-regering-mcp<br/>32 Tools]
        ClaudeAPI[🤖 Claude API<br/>GitHub Copilot<br/>200K Context Window]
        Riksdag[🏛️ Riksdag API<br/>data.riksdagen.se<br/>Public Open Data]
        G0V[📋 g0v.se<br/>Government Documents<br/>Markdown Export]
    end
    
    HTML --> Dashboard
    CSS --> Dashboard
    
    Workflow1 --> ClaudeAPI
    Workflow2 --> ClaudeAPI
    Workflow3 --> ClaudeAPI
    
    Workflow1 --> MCP
    Workflow2 --> MCP
    Workflow3 --> MCP
    
    Deploy --> S3Primary
    S3Primary --> S3Replica
    
    CDN --> S3Primary
    DNS --> CDN
    DNS --> GHPages
    
    MCP --> Riksdag
    MCP --> G0V
    
    Dashboard -.->|CDN Load| CDN
    
    style HTML fill:#e3f2fd,color:#000
    style CSS fill:#e3f2fd,color:#000
    style Dashboard fill:#4caf50,color:#000
    style Workflow1 fill:#ff9800,color:#000
    style Workflow2 fill:#ff9800,color:#000
    style Workflow3 fill:#ff9800,color:#000
    style Deploy fill:#ff9800,color:#000
    style CDN fill:#2196f3,color:#fff
    style S3Primary fill:#2196f3,color:#fff
    style S3Replica fill:#2196f3,color:#fff
    style DNS fill:#2196f3,color:#fff
    style GHPages fill:#9c27b0,color:#fff
    style MCP fill:#f44336,color:#fff
    style ClaudeAPI fill:#f44336,color:#fff
    style Riksdag fill:#9e9e9e,color:#000
    style G0V fill:#9e9e9e,color:#000
```

### **🔄 Data Flow Diagram with STRIDE per Element**

```mermaid
graph LR
    subgraph "DFD Legend"
        EE[🌍 External Entity<br/>STRIDE: S,R]
        P[⚙️ Process<br/>STRIDE: S,T,R,I,D,E]
        DS[💾 Data Store<br/>STRIDE: T,R,I,D]
        DF[→ Data Flow<br/>STRIDE: T,I,D]
    end
    
    User[🌍 End User<br/>Global Audience]
    Browser[🌐 Web Browser<br/>JavaScript Runtime]
    
    CDN[☁️ CloudFront CDN<br/>Content Delivery]
    S3Store[💾 S3 Bucket<br/>Static Assets]
    
    GHActions[⚙️ GitHub Actions<br/>CI/CD Workflows]
    AIWorkflow[⚙️ AI News Generator<br/>Claude + MCP]
    Repo[💾 Git Repository<br/>Source Code]
    
    MCPServer[🔌 MCP Server<br/>Political Data API]
    RiksdagData[💾 Riksdag Database<br/>Parliamentary Records]
    
    User -->|1. HTTPS Request| Browser
    Browser -->|2. GET /index.html| CDN
    CDN -->|3. Fetch Asset| S3Store
    S3Store -->|4. Return HTML/CSS/JS| CDN
    CDN -->|5. Deliver Content| Browser
    Browser -->|6. Load Chart.js/D3.js| CDN
    
    GHActions -->|7. Trigger Schedule| AIWorkflow
    AIWorkflow -->|8. Query Political Data| MCPServer
    MCPServer -->|9. Fetch Riksdag Records| RiksdagData
    RiksdagData -->|10. Return JSON| MCPServer
    MCPServer -->|11. Return Political Data| AIWorkflow
    AIWorkflow -->|12. Generate HTML Article| GHActions
    GHActions -->|13. Deploy Content| S3Store
    
    style User fill:#90caf9,color:#000
    style Browser fill:#e3f2fd,color:#000
    style CDN fill:#ff9800,color:#000
    style S3Store fill:#4caf50,color:#000
    style GHActions fill:#4caf50,color:#000
    style AIWorkflow fill:#f44336,color:#fff
    style Repo fill:#4caf50,color:#000
    style MCPServer fill:#9c27b0,color:#fff
    style RiksdagData fill:#9e9e9e,color:#000
```

### **🎭 STRIDE per DFD Element Analysis**

#### 🌍 External Entity: End User
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation |
|-----------------|--------|-----------|--------|-----------|-----------|
| **Spoofing** | User impersonates legitimate Swedish citizen (N/A - no auth) | N/A | N/A | N/A | No authentication required (public site) |
| **Repudiation** | User denies viewing content (N/A - read-only) | N/A | N/A | N/A | No user actions logged (privacy-by-design) |

#### ⚙️ Process: GitHub Actions CI/CD
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Spoofing** | Attacker impersonates GitHub Actions workflow | LOW (2) | HIGH (8) | 1.6 | OIDC authentication, workflow approvals, audit logs | **LOW** |
| **Tampering** | Malicious workflow modification | LOW (2) | CRITICAL (10) | 2.0 | Branch protection, required reviews, GPG signing | **LOW** |
| **Repudiation** | Workflow execution denial | VERY LOW (1) | LOW (3) | 0.3 | GitHub audit logs (immutable), CloudTrail | **VERY LOW** |
| **Info Disclosure** | Secrets leaked in workflow logs | LOW (2) | HIGH (8) | 1.6 | Secret scanning, masked secrets, OIDC (no long-lived keys) | **LOW** |
| **DoS** | Workflow quota exhaustion | MEDIUM (3) | MEDIUM (5) | 1.5 | GitHub quota monitoring, rate limiting, graceful degradation | **LOW** |
| **Elevation of Privilege** | Workflow gains excessive permissions | LOW (2) | HIGH (8) | 1.6 | Least privilege IAM, scoped tokens, permission reviews | **LOW** |

#### ⚙️ Process: AI News Generator (Claude Opus 4.7 + MCP)
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Spoofing** | Fake MCP server returns fabricated data | LOW (2) | CRITICAL (10) | 2.0 | HTTPS-only, server health monitoring, cross-verification | **LOW** |
| **Tampering** | Prompt injection manipulates AI output | MEDIUM (3) | HIGH (8) | 2.4 | Input sanitization, output validation, PR review | **MEDIUM** |
| **Repudiation** | AI-generated content attribution unclear | VERY LOW (1) | MEDIUM (5) | 0.5 | EU AI Act disclosure, workflow logs, attribution metadata | **VERY LOW** |
| **Info Disclosure** | Hallucinated parliamentary data published | MEDIUM (3) | CRITICAL (10) | 3.0 | Document ID validation, fact-checking, reviewer training | **MEDIUM** |
| **DoS** | API rate limiting blocks content generation | MEDIUM (3) | MEDIUM (5) | 1.5 | Graceful degradation, manual fallback, quota monitoring | **LOW** |
| **Elevation of Privilege** | Jailbreak bypasses AI safety guardrails | LOW (2) | HIGH (8) | 1.6 | Anthropic built-in guardrails, output validation, PR review | **LOW** |

#### 💾 Data Store: S3 Bucket (Static Assets)
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Tampering** | Unauthorized S3 object modification | VERY LOW (1) | HIGH (8) | 0.8 | IAM least privilege, S3 versioning, bucket policy, MFA delete | **VERY LOW** |
| **Repudiation** | S3 access denial | VERY LOW (1) | LOW (3) | 0.3 | S3 access logs, CloudTrail, versioning history | **VERY LOW** |
| **Info Disclosure** | Unauthorized S3 bucket access | VERY LOW (1) | MEDIUM (5) | 0.5 | S3 bucket policy (deny public except CloudFront), IAM roles | **VERY LOW** |
| **DoS** | S3 bucket deletion | VERY LOW (1) | HIGH (8) | 0.8 | MFA delete, cross-region replication, GitHub Pages DR | **VERY LOW** |

#### 💾 Data Store: Git Repository
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Tampering** | Repository history rewriting | VERY LOW (1) | HIGH (8) | 0.8 | Branch protection, GPG signed commits, immutable git history | **VERY LOW** |
| **Repudiation** | Commit authorship spoofing | VERY LOW (1) | MEDIUM (5) | 0.5 | GPG commit signing (verified commits), GitHub audit logs | **VERY LOW** |
| **Info Disclosure** | Secret committed to repository | LOW (2) | CRITICAL (10) | 2.0 | Secret scanning (GitHub), pre-commit hooks, .gitignore | **LOW** |
| **DoS** | Repository unavailable | VERY LOW (1) | MEDIUM (5) | 0.5 | GitHub SLA, local clones, multiple contributors | **VERY LOW** |

#### → Data Flow: HTTPS Request (User → CloudFront)
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Tampering** | Man-in-the-Middle attack | VERY LOW (1) | HIGH (8) | 0.8 | TLS 1.3, HSTS preload, Certificate Transparency | **VERY LOW** |
| **Info Disclosure** | Traffic sniffing | VERY LOW (1) | LOW (3) | 0.3 | TLS 1.3 encryption, HSTS | **VERY LOW** |
| **DoS** | DDoS attack on CloudFront | LOW (2) | MEDIUM (5) | 1.0 | AWS Shield Standard, CloudFront global distribution, GitHub Pages DR | **LOW** |

#### → Data Flow: API Request (GitHub Actions → MCP Server)
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Tampering** | Response manipulation (MITM) | LOW (2) | CRITICAL (10) | 2.0 | HTTPS-only, TLS certificate validation | **LOW** |
| **Info Disclosure** | Stale/incorrect political data | MEDIUM (3) | HIGH (8) | 2.4 | Freshness validation (<48h), cross-verification | **MEDIUM** |
| **DoS** | MCP server unavailable | LOW (2) | MEDIUM (5) | 1.0 | Health checks, failsafe mode (skip generation), manual fallback | **LOW** |

#### → Process: Aggregate → Render News Pipeline (`scripts/aggregate-analysis.ts` + `scripts/render-articles.ts`)
| STRIDE Category | Threat | Likelihood | Impact | Risk Score | Mitigation | Residual Risk |
|-----------------|--------|-----------|--------|-----------|-----------|--------------|
| **Tampering** | Aggregated markdown silently diverges from source artifacts (drift, dropped sections, reordered evidence) | MEDIUM (3) | HIGH (7) | 2.1 | Aggregator emits SHA-256 manifest of every consumed `analysis/daily/$DATE/$SUB/*.md`; manifest is embedded in JSON-LD `NewsArticle.citation` and committed alongside `article.md`; renderer refuses to render if manifest is stale | **LOW** |
| **Info Disclosure** | AI prompt-injection content in analysis artifacts surfaces into HTML (hidden `<script>`, `onclick=` handlers, `javascript:` URIs) | MEDIUM (3) | CRITICAL (9) | 2.7 | `rehype-sanitize` schema with strict allow-list; `<pre class="mermaid">` is the only HTML extension permitted; `mermaid-init.mjs` renders client-side without `eval`; CSP blocks remaining inline script execution | **LOW** |
| **Repudiation** | Article makes unattributed claims that cannot be traced back to source artifacts | MEDIUM (3) | HIGH (7) | 2.1 | Aggregator emits per-artifact citation block in article footer; every methodology + template used is linked to its GitHub blob URL; `NewsArticle.about` + `NewsArticle.citation` JSON-LD encode the full evidence chain | **LOW** |

### **📊 Risk Score Summary (STRIDE per Element)**

| Element Type | Total Threats | Critical Risk (8.0+) | High Risk (4.0-7.9) | Medium Risk (2.0-3.9) | Low Risk (<2.0) |
|-------------|---------------|---------------------|--------------------|--------------------|----------------|
| **External Entities** | 0 | 0 | 0 | 0 | 0 |
| **Processes** | 12 | 0 | 0 | 4 | 8 |
| **Data Stores** | 8 | 0 | 0 | 1 | 7 |
| **Data Flows** | 6 | 0 | 0 | 2 | 4 |
| **TOTAL** | **26** | **0** | **0** | **7** | **19** |

**Highest Risk Elements:**
1. **AI News Generator (Info Disclosure):** Hallucination risk - Risk Score 3.0 → **MEDIUM**
2. **AI News Generator (Tampering):** Prompt injection - Risk Score 2.4 → **MEDIUM**
3. **Data Flow (MCP API):** Stale data - Risk Score 2.4 → **MEDIUM**
4. **Git Repository (Info Disclosure):** Secret commits - Risk Score 2.0 → **LOW** (borderline)
5. **GitHub Actions (Tampering):** Malicious workflow - Risk Score 2.0 → **LOW** (borderline)

---

## 🎖️ MITRE ATT&CK Framework Integration

Following [Hack23 Threat Modeling Policy § 4.1](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#attacker-centric-mitre-attck), we map applicable MITRE ATT&CK tactics and techniques to system components. This attacker-centric analysis identifies real-world adversary behaviors.

### **🎯 Applicable MITRE ATT&CK Tactics**

| Tactic | Techniques Mapped | Riksdagsmonitor Relevance | Priority |
|--------|------------------|--------------------------|----------|
| **Initial Access (TA0001)** | 4 techniques | Primary attack vector for web infrastructure | **HIGH** |
| **Execution (TA0002)** | 3 techniques | XSS, malicious JavaScript, CI/CD exploitation | **HIGH** |
| **Persistence (TA0003)** | 2 techniques | Repository backdoors, GitHub account compromise | **MEDIUM** |
| **Defense Evasion (TA0005)** | 3 techniques | Obfuscated JavaScript, commit history manipulation | **MEDIUM** |
| **Credential Access (TA0006)** | 2 techniques | GitHub secrets, AWS credentials | **HIGH** |
| **Discovery (TA0007)** | 2 techniques | Infrastructure reconnaissance | **LOW** |
| **Collection (TA0009)** | 1 technique | Source code exfiltration | **LOW** |
| **Command and Control (TA0011)** | 1 technique | Malicious CDN compromise | **LOW** |
| **Impact (TA0040)** | 5 techniques | Website defacement, data manipulation, DoS | **CRITICAL** |

### **🔍 MITRE ATT&CK Technique Mapping**

#### Tactic: Initial Access (TA0001)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1566.002** | Phishing: Spearphishing Link | Spearphishing Link | GitHub Account | Attacker phishes contributor to steal GitHub credentials | MFA alerts, suspicious login detection | MFA enforcement, security training | **LOW** |
| **T1190** | Exploit Public-Facing Application | N/A | GitHub Pages, CloudFront | Exploit vulnerability in CDN or GitHub infrastructure | Vendor security advisories | AWS/GitHub security patching (vendor responsibility) | **VERY LOW** |
| **T1078.004** | Valid Accounts: Cloud Accounts | Cloud Accounts | AWS, GitHub | Compromised GitHub account with write access | GitHub audit logs, AWS CloudTrail | MFA, OIDC (no long-lived keys), least privilege | **LOW** |
| **T1195.002** | Supply Chain Compromise: Software Supply Chain | Compromise Software Supply Chain | Chart.js/D3.js CDN | Compromised jsDelivr serves malicious Chart.js | SRI hash validation failure | SRI hashes, manual CDN version review | **LOW** |

#### Tactic: Execution (TA0002)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1059.007** | Command and Scripting Interpreter: JavaScript | JavaScript | Dashboard (Chart.js/D3.js) | XSS injection in dashboard code | CSP violation reports, browser console errors | CSP headers, input sanitization, SRI | **LOW** |
| **T1106** | Native API | N/A | GitHub Actions | Malicious workflow uses GitHub API | Workflow approval logs, API rate limiting | Required workflow approvals, least privilege tokens | **LOW** |
| **T1203** | Exploitation for Client Execution | N/A | Browser (end user) | Exploit browser vulnerability via malicious JavaScript | Browser vendor patches | CSP, SRI, trusted CDN, regular browser updates (user responsibility) | **VERY LOW** |

#### Tactic: Persistence (TA0003)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1098.001** | Account Manipulation: Additional Cloud Credentials | Cloud Credentials | GitHub, AWS | Attacker adds SSH key to compromised GitHub account | GitHub audit logs, SSH key addition alerts | MFA, SSH key reviews, GPG signing | **LOW** |
| **T1505.003** | Server Software Component: Web Shell | Web Shell | S3 Bucket (impossible for static content) | N/A - Static website, no server-side execution | N/A | Architecture (static-only, no server-side code) | **N/A** |

#### Tactic: Defense Evasion (TA0005)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1027** | Obfuscated Files or Information | N/A | Dashboard JavaScript | Obfuscated malicious JavaScript bypasses code review | Code review, minification analysis | Mandatory code review, linting (ESLint), CodeQL | **LOW** |
| **T1070.004** | Indicator Removal: File Deletion | File Deletion | Git Repository | Attacker deletes commit history to hide backdoor | Git immutable history, audit logs | Branch protection, Git history immutability | **VERY LOW** |
| **T1562.001** | Impair Defenses: Disable or Modify Tools | Disable Security Tools | GitHub Actions | Disable secret scanning or CodeQL in workflow | Workflow file changes (PR review) | Branch protection, required reviews, CODEOWNERS | **LOW** |

#### Tactic: Credential Access (TA0006)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1552.001** | Unsecured Credentials: Credentials In Files | Credentials In Files | Git Repository | AWS credentials committed to repository history | GitHub secret scanning | Secret scanning, pre-commit hooks, .gitignore | **LOW** |
| **T1552.004** | Unsecured Credentials: Private Keys | Private Keys | Developer Workstation | SSH private key stolen from developer machine | N/A (endpoint security out of scope) | SSH key passphrases, endpoint protection (user responsibility) | **LOW** |

#### Tactic: Discovery (TA0007)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1083** | File and Directory Discovery | N/A | GitHub Repository | Attacker explores public repository structure | N/A (public repository) | Accept risk (open source by design) | **N/A** |
| **T1580** | Cloud Infrastructure Discovery | N/A | AWS Infrastructure | Attacker enumerates S3 buckets, CloudFront distributions | AWS CloudTrail | S3 bucket policy (block public listing), IAM least privilege | **LOW** |

#### Tactic: Collection (TA0009)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1213** | Data from Information Repositories | N/A | GitHub Repository | Attacker clones public repository | N/A (public repository) | Accept risk (open source by design) | **N/A** |

#### Tactic: Command and Control (TA0011)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1071.001** | Application Layer Protocol: Web Protocols | Web Protocols | Compromised Dashboard | XSS establishes C2 via HTTPS | Network monitoring, CSP violation reports | CSP, SRI, input sanitization | **VERY LOW** |

#### Tactic: Impact (TA0040)

| Technique ID | Technique Name | Sub-Technique | System Component | Attack Scenario | Detection | Mitigation | Likelihood |
|--------------|---------------|---------------|------------------|-----------------|-----------|-----------|-----------|
| **T1485** | Data Destruction | N/A | S3 Bucket, Git Repository | Attacker deletes political data | S3 versioning, Git history | S3 versioning, MFA delete, cross-region replication, Git immutability | **VERY LOW** |
| **T1491.001** | Defacement: Internal Defacement | Internal Defacement | Repository Content | Malicious commit defaces website | Code review, PR approval | Branch protection, required reviews, GPG signing | **LOW** |
| **T1498** | Network Denial of Service | N/A | CloudFront, GitHub Pages | DDoS attack on CDN | AWS Shield alerts, CloudWatch alarms | AWS Shield Standard, GitHub Pages DR, multi-region | **LOW** |
| **T1499.004** | Endpoint Denial of Service: Application or System Exploitation | Client-Side DoS | Dashboard JavaScript | Malicious data crashes Chart.js rendering | Browser crash reports, user reports | Dashboard error handling, data validation | **LOW** |
| **T1565.002** | Data Manipulation: Transmitted Data Manipulation | Transmitted Data | MCP Server → AI Workflow | MITM modifies political data in transit | TLS validation | HTTPS-only, certificate validation, freshness checks | **LOW** |

### **📊 MITRE ATT&CK Coverage Summary**

| Metric | Value | Analysis |
|--------|-------|----------|
| **Total Tactics Covered** | 9 / 14 | 64% coverage (appropriate for frontend-only architecture) |
| **Total Techniques Mapped** | 23 | Comprehensive for static website + AI workflows |
| **HIGH Priority Techniques** | 7 | Focus on Initial Access, Execution, Credential Access, Impact |
| **Vendor-Dependent Mitigations** | 5 | AWS, GitHub, Anthropic security responsibilities |
| **Architecture-Based Mitigations** | 8 | Static-only design eliminates server-side attacks |

### **🎯 MITRE ATT&CK-Based Detection Opportunities**

| Detection Category | Techniques Detected | Detection Method | Implementation Status |
|-------------------|-------------------|------------------|----------------------|
| **GitHub Audit Logs** | T1078.004, T1098.001, T1070.004 | Real-time alerting on suspicious account activity | ✅ **Implemented** |
| **AWS CloudTrail** | T1580, T1098.001 | Infrastructure change monitoring | ✅ **Implemented** |
| **Secret Scanning** | T1552.001 | Automated credential detection in commits | ✅ **Implemented** |
| **CSP Violation Reports** | T1059.007, T1071.001 | Browser-based security policy enforcement | ✅ **Implemented** |
| **SRI Hash Validation** | T1195.002 | CDN integrity verification | ✅ **Implemented** |
| **Workflow Approval Logs** | T1106, T1562.001 | CI/CD security gate logging | ✅ **Implemented** |
| **AWS Shield Metrics** | T1498 | DDoS detection and mitigation | ✅ **Implemented** (AWS managed) |

### **📊 ATT&CK Coverage Analysis**

Visual coverage matrix showing detection and mitigation status per MITRE ATT&CK tactic/technique for the riksdagsmonitor static website + AI workflow context.

#### Coverage Matrix by Tactic

| ATT&CK Tactic | Techniques in Scope | Detected | Mitigated | Coverage % | Detection Gap |
|---------------|--------------------:|:--------:|:---------:|:----------:|---------------|
| **TA0001 Initial Access** | T1189, T1195.002, T1078.004 | ✅ 3/3 | ✅ 3/3 | **100%** | None — SRI, OIDC, MFA cover all paths |
| **TA0002 Execution** | T1059.007, T1106 | ✅ 2/2 | ✅ 2/2 | **100%** | None — CSP + static architecture eliminate JS execution paths |
| **TA0003 Persistence** | T1176, T1098.001 | ✅ 2/2 | ✅ 2/2 | **100%** | None — branch protection prevents unauthorized persistence |
| **TA0004 Privilege Escalation** | T1611 | ✅ 1/1 | ✅ 1/1 | **100%** | None — OIDC short-lived tokens, no persistent elevated access |
| **TA0005 Defense Evasion** | T1070.004, T1562.001 | ✅ 2/2 | ✅ 2/2 | **100%** | None — GitHub immutable audit logs prevent log tampering |
| **TA0006 Credential Access** | T1552.001, T1606.002 | ✅ 2/2 | ✅ 2/2 | **100%** | None — secret scanning + OIDC (no long-lived secrets) |
| **TA0007 Discovery** | T1580 | ✅ 1/1 | ✅ 1/1 | **100%** | None — CloudTrail monitors all discovery activity |
| **TA0010 Exfiltration** | T1048, T1567 | ⚠️ 1/2 | ✅ 2/2 | **50%** | **GAP:** No automated detection for slow data exfiltration via CDN |
| **TA0040 Impact** | T1498, T1485, T1491.002, T1659 | ⚠️ 3/4 | ✅ 4/4 | **75%** | **GAP:** T1659 (Content Injection) detection relies on manual PR review |
| **TA0011 C&C** | T1071.001, T1071.004 | ⚠️ 1/2 | ✅ 2/2 | **50%** | **GAP:** No network-level C&C detection (static hosting, vendor-dependent) |
| **TA0008 Lateral Movement** | N/A (no server-side) | N/A | ✅ Eliminated | **100%** | None — static architecture eliminates lateral movement entirely |
| **TA0009 Collection** | N/A (no private data) | N/A | ✅ Eliminated | **100%** | None — no private user data to collect |
| **TA0043 Reconnaissance** | N/A (public repo) | N/A | ⚠️ Accepted | **N/A** | Accepted risk — public repository, open-source platform |

> **Legend:** ✅ = fully detected/mitigated | ⚠️ = partial detection (gap exists) — number shows detected/total techniques

**Overall ATT&CK Coverage:** **23/23 relevant techniques** mapped | **20/23 with automated detection** | **3 with manual/vendor detection**

#### Detection Gap Identification

| Gap ID | Technique | Tactic | Gap Description | Remediation | Target Date |
|--------|-----------|--------|-----------------|-------------|-------------|
| **ATT-GAP-001** | T1659 (Content Injection) | TA0040 Impact | AI-generated content injection detected only at manual PR review — no automated semantic validation | Implement automated dok_id API verification against riksdag-regering-mcp | Q1 2026 |
| **ATT-GAP-002** | T1048 (Exfil over C2) | TA0010 Exfiltration | No automated detection for slow exfiltration via CDN abuse or covert channel through publicly-visible content | Add CDN anomaly alerting via CloudFront access log analysis | Q2 2026 |
| **ATT-GAP-003** | T1071.004 (DNS as C2) | TA0011 C&C | Static site cannot inspect DNS traffic; vendor-dependent (AWS Route 53 monitoring) | Enhance Route 53 DNS query logging and alerting; enable Route 53 Resolver Query Logs | Q2 2026 |

### **🔪 Kill Chain Disruption Analysis**

Per [Hack23 Threat Modeling Policy § 4.1.4](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md), mapping defensive controls to each Cyber Kill Chain phase for Riksdagsmonitor:

| Kill Chain Phase | Attacker Activity (Riksdagsmonitor Context) | Defensive Control | Detection Mechanism | Disruption Effectiveness |
|-----------------|---------------------------------------------|-------------------|---------------------|--------------------------|
| **1. Reconnaissance** | Scan public GitHub repo for secrets, enumerate AWS infrastructure, identify AI workflow schedules | Public repo accepted risk; minimal metadata exposure via `.gitignore`, S3 bucket policy, no directory listing | Repository traffic anomaly (GitHub Insights), Route 53 query logs | ⚠️ 60% — Public repo limits concealment |
| **2. Weaponization** | Craft malicious npm package, prepare XSS payload, develop AI prompt injection | N/A — occurs off-target; no direct defense | Threat intelligence feeds (ENISA, CERT-SE, MITRE ATT&CK updates) | ⚠️ 30% — Attacker-side activity |
| **3. Delivery** | Submit malicious PR, phishing for GitHub credentials, CDN asset substitution | Branch protection (PREV-002), MFA (PREV-001), SRI hashes (PREV-012), SHA-pinned Actions (PREV-015) | Dependabot alerts (DET-007), SRI failure (DET-006), CodeQL (DET-008) | ✅ 95% — Multi-layer delivery blocking |
| **4. Exploitation** | Execute XSS via CDN compromise, exploit vulnerable dependency, AI prompt injection | CSP (PREV-011), Dependabot patching (PREV-013), input sanitization (PREV-023), HTTPS-only (PREV-009) | CSP violation reports (DET-005), CodeQL findings (DET-008), PR review rejection (DET-012) | ✅ 92% — Static architecture limits exploitation |
| **5. Installation** | Persist via modified GitHub Actions workflow, inject into build pipeline | Workflow approval (PREV-016), CODEOWNERS (PREV-004), Git immutable history | Workflow execution logs (DET-009), GitHub audit logs (DET-001) | ✅ 90% — No server-side persistence possible |
| **6. Command & Control** | Covert C2 via DNS tunneling, CDN abuse for data exfiltration | Static architecture eliminates server-side C2; Route 53 monitoring | CloudTrail (DET-002), Route 53 DNS query logs | ⚠️ 70% — Limited by static-site architecture (vendor-dependent) |
| **7. Actions on Objectives** | Deface website, inject disinformation, manipulate political data, DDoS during elections | S3 versioning (PREV-019), Git revert (CORR-001), DR failover (CORR-003), mandatory PR review (PREV-028) | CloudWatch alarms (DET-004), Shield metrics (DET-010), content integrity monitoring | ✅ 97% — Rapid rollback + multi-region DR |

**Kill Chain Disruption Summary:**
- **Strongest disruption:** Phase 3 (Delivery) at 95% and Phase 7 (Actions on Objectives) at 97% — multi-layer preventive and corrective controls
- **Weakest disruption:** Phase 2 (Weaponization) at 30% — attacker-side activity, mitigated by threat intelligence
- **Architecture advantage:** Static website + no server-side code eliminates Phases 5-6 attack surface almost entirely
- **Overall Kill Chain Disruption Score:** **76%** (simple average across all phases)

---

## 🌳 Attack Tree Analysis

Structured attack tree analysis for the top 3 high-priority attack scenarios against Riksdagsmonitor. Each tree decomposes the attacker's goal into sub-goals and leaf-node attack actions with success probabilities.

### 🎯 Attack Tree 1: Website Defacement via Repository Compromise

**Attacker Goal:** Replace riksdagsmonitor.com homepage content with disinformation or political messaging  
**Threat Actor:** Hacktivist (Intermediate) / Nation-State Actor  
**Overall Probability:** ~2.3% (limited by MFA, branch protection, and required PR review)

```mermaid
graph TD
    Goal["🎯 GOAL: Deface Riksdagsmonitor Website<br/>Replace homepage with disinformation content"]

    subgraph PathA["Path A: GitHub Account Compromise [~4% combined]"]
        A1["🎣 Phishing Contributor<br/>P=15%"]
        A2["💀 Credential Malware<br/>P=10%"]
        A3["🔑 SSH Key Theft<br/>P=5%"]
        MFA["⛔ Bypass GitHub MFA<br/>P=20% (if OTP captured)"]
        BProt["⛔ Bypass Branch Protection<br/>P=5% (force push blocked)"]
    end

    subgraph PathB["Path B: Supply Chain Injection [~0.5% combined]"]
        B1["📦 Compromise npm Package<br/>P=2% (Dependabot active)"]
        B2["🔗 Compromise GitHub Action<br/>P=1% (SHA-pinned)"]
        B3["🌐 Compromise jsDelivr CDN<br/>P=0.5% (SRI enforced)"]
        SRI["⛔ SRI Hash Mismatch Blocked<br/>P=99.9% detection"]
    end

    subgraph PathC["Path C: Social Engineering PR [~1% combined]"]
        C1["👤 Impersonate Contributor<br/>P=10%"]
        C2["📄 Submit Malicious PR<br/>P=100% submission"]
        C3["🤝 Deceive Reviewer<br/>P=5% approval"]
    end

    subgraph Mitigations["🛡️ Active Mitigations"]
        M1["✅ MFA Required (GitHub Org Policy)"]
        M2["✅ Branch Protection (required reviews)"]
        M3["✅ SRI Hashes (CDN integrity)"]
        M4["✅ Dependabot (npm vuln scanning)"]
        M5["✅ SHA-pinned GitHub Actions"]
        M6["✅ Git Rollback in <30 minutes"]
    end

    A1 --> MFA
    A2 --> MFA
    A3 --> MFA
    MFA --> BProt
    BProt -->|"P=5%"| Goal

    B1 --> SRI
    B2 --> SRI
    B3 --> SRI
    SRI -->|"P=0.1% bypass"| Goal

    C1 --> C2
    C2 --> C3
    C3 -->|"P=5%"| Goal

    M1 -.->|"Blocks"| MFA
    M2 -.->|"Blocks"| BProt
    M3 -.->|"Blocks"| SRI
    M4 -.->|"Reduces"| B1
    M5 -.->|"Blocks"| B2
    M6 -.->|"Recovers from"| Goal

    style Goal fill:#f44336,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#4caf50,color:#000
    style M6 fill:#4caf50,color:#000
```

### 🎯 Attack Tree 2: Election Misinformation via Data Manipulation

**Attacker Goal:** Publish falsified Swedish election data (seat predictions, voting records) to mislead voters  
**Threat Actor:** Nation-State APT (Russia/China/Iran) / Disinformation Campaign Operator  
**Overall Probability:** ~1.4% per year (primary strategic threat to democratic mission)

```mermaid
graph TD
    Goal["🎯 GOAL: Publish Election Misinformation<br/>Falsify seat forecasts / voting records"]

    subgraph PathA["Path A: AI Prompt Injection [~3% combined]"]
        A1["💉 Inject via Riksdag Document<br/>P=5% (malicious dok_id content)"]
        A2["🤖 Context Window Overflow<br/>P=3% (exceeds token limit)"]
        A3["🔄 Multi-turn Manipulation<br/>P=2% (session persistence)"]
        PRReview["⛔ PR Human Review Gate<br/>P=95% detection rate"]
    end

    subgraph PathB["Path B: MCP Server Compromise [~1% combined]"]
        B1["☁️ Compromise Render.com Host<br/>P=2%"]
        B2["🔌 Poison riksdag-regering API<br/>P=1% (requires Riksdag API access)"]
        B3["🌐 DNS Spoofing of MCP Server<br/>P=0.5%"]
        Fresh["⛔ Freshness Check Fails<br/>P=95% detection (>48h stale)"]
    end

    subgraph PathC["Path C: Repository Manipulation [~0.5%]"]
        C1["🗂️ Tamper CSV Political Data<br/>P=1% (S3 versioning guards)"]
        C2["📊 Manipulate Chart.js Config<br/>P=0.5%"]
        S3V["⛔ S3 Versioning + Git History<br/>P=99% rollback detection"]
    end

    subgraph Mitigations["🛡️ Active Mitigations"]
        M1["✅ Mandatory PR Human Review (Hack23 Policy)"]
        M2["✅ dok_id Validation (Riksdag API)"]
        M3["✅ MCP Freshness Checks (<48h)"]
        M4["✅ S3 Versioning (all data immutable)"]
        M5["✅ CSP Headers (no external script injection)"]
        M6["⚠️ Planned: Automated fact-checking Q1 2026"]
    end

    A1 --> PRReview
    A2 --> PRReview
    A3 --> PRReview
    PRReview -->|"P=5% bypass"| Goal

    B1 --> Fresh
    B2 --> Fresh
    B3 --> Fresh
    Fresh -->|"P=5% bypass"| Goal

    C1 --> S3V
    C2 --> S3V
    S3V -->|"P=1% bypass"| Goal

    M1 -.->|"Primary gate"| PRReview
    M2 -.->|"Validates"| A1
    M3 -.->|"Validates"| Fresh
    M4 -.->|"Blocks"| C1
    M5 -.->|"Blocks"| C2
    M6 -.->|"Future"| PRReview

    style Goal fill:#f44336,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#4caf50,color:#000
    style M6 fill:#ff9800,color:#000
```

### 🎯 Attack Tree 3: Supply Chain Attack via CDN Compromise (Chart.js/D3.js)

**Attacker Goal:** Inject malicious JavaScript via Chart.js or D3.js CDN to execute cryptojacking or data exfiltration  
**Threat Actor:** Cybercriminal / State Actor (supply chain compromise)  
**Overall Probability:** ~0.1% per year (mitigated primarily by SRI hashes)

```mermaid
graph TD
    Goal["🎯 GOAL: Execute Malicious JS via CDN<br/>Cryptojacking / data exfiltration / XSS"]

    subgraph PathA["Path A: jsDelivr CDN Compromise [~0.2%]"]
        A1["🏴‍☠️ Hack jsDelivr Infrastructure<br/>P=0.1% (major CDN operator)"]
        A2["📦 Compromise Chart.js npm Package<br/>P=0.5% (source code injection)"]
        A3["🔗 DNS Hijack jsDelivr Domain<br/>P=0.2%"]
        SRI["⛔ SRI Hash Verification Fails<br/>Browser refuses to execute<br/>P=99.9% blocking rate"]
    end

    subgraph PathB["Path B: Malicious Chart.js Release [~0.05%]"]
        B1["👨‍💻 Compromise Chart.js Maintainer<br/>P=0.1% (2FA on npm)"]
        B2["🔧 Inject Backdoor in Release<br/>P=50% if maintainer compromised"]
        B3["📋 Dependabot Raises Alert<br/>P=95% detection"]
        LockFile["⛔ package-lock.json Integrity<br/>P=99% catches version changes"]
    end

    subgraph PathC["Path C: XSS via Chart.js Config [~0.5%]"]
        C1["📊 Inject via Dashboard Data Input<br/>P=2%"]
        C2["🔄 Exploit Chart.js Rendering<br/>P=1%"]
        CSP["⛔ Content Security Policy Blocks<br/>P=99% JS execution blocked"]
    end

    subgraph Mitigations["🛡️ Active Mitigations"]
        M1["✅ SRI Hashes (sha384 on all CDN assets)"]
        M2["✅ CSP script-src with strict hashes"]
        M3["✅ Dependabot (automated npm audit)"]
        M4["✅ Manual CDN review (quarterly)"]
        M5["✅ package-lock.json versioned in Git"]
        M6["✅ No user input to dashboard rendering"]
    end

    A1 --> SRI
    A2 --> SRI
    A3 --> SRI
    SRI -->|"P=0.1% bypass"| Goal

    B1 --> B2
    B2 --> B3
    B2 --> LockFile
    B3 -->|"P=5% missed"| LockFile
    LockFile -->|"P=1% bypass"| Goal

    C1 --> CSP
    C2 --> CSP
    CSP -->|"P=1% bypass"| Goal

    M1 -.->|"Primary block"| SRI
    M2 -.->|"Secondary block"| CSP
    M3 -.->|"Detects"| B2
    M4 -.->|"Validates"| SRI
    M5 -.->|"Blocks"| LockFile
    M6 -.->|"Eliminates"| C1

    style Goal fill:#f44336,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#4caf50,color:#000
    style M6 fill:#4caf50,color:#000
```

**Attack Tree Summary:**

| Tree | Attack Goal | Overall Probability | Residual Risk | Key Mitigation |
|------|-------------|--------------------:|---------------|----------------|
| **AT-1** | Website Defacement | ~2.3% | LOW | MFA + Branch Protection + PR Review |
| **AT-2** | Election Misinformation | ~1.4% | **MEDIUM** | PR Review + dok_id validation (automation gap) |
| **AT-3** | CDN Supply Chain JS Injection | ~0.1% | LOW | SRI hashes + CSP (near-complete protection) |

---

## 🎯 Priority Threat Scenarios

Following [Hack23 Threat Modeling Policy § 4.4](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#scenario-centric-misuse-cases), we develop realistic attack scenarios with embedded attack trees showing attack paths, success probabilities, and critical mitigations.

### **Scenario 1: Website Defacement via Repository Compromise**

**🎭 Threat Actor:** Hacktivist (Script Kiddie to Intermediate)  
**🎯 Motivation:** Political disruption, media attention  
**💰 Financial Impact:** $20,000 (reputation damage)  
**⏱️ Recovery Time:** 15-30 minutes (Git rollback)  
**📊 Likelihood:** LOW (2/5) | **Impact:** HIGH (8/10) | **Risk Score:** 1.6/10

#### Attack Tree:

```mermaid
graph TB
    Goal[🎯 Deface Riksdagsmonitor Website<br/>Replace homepage with political message]
    
    subgraph "Attack Path 1: Compromise GitHub Account [40% probability]"
        A1[Phishing Attack on Contributor<br/>15% success rate]
        A2[Credential Theft via Malware<br/>10% success rate]
        A3[SSH Key Theft<br/>5% success rate]
        A4[GitHub Session Hijacking<br/>10% success rate]
        
        A1 --> Bypass1[Bypass MFA<br/>20% success if phishing includes MFA token]
        A2 --> Bypass1
        A3 --> Bypass2[Use Stolen SSH Key<br/>100% success if no passphrase]
        A4 --> Bypass1
    end
    
    subgraph "Attack Path 2: Exploit GitHub Vulnerability [<1% probability]"
        B1[Discover GitHub Zero-Day<br/><0.1% likelihood]
        B2[Exploit Authentication Bypass<br/><0.1% likelihood]
        
        B1 --> B2
    end
    
    subgraph "Attack Path 3: Social Engineering Maintainer [15% probability]"
        C1[Impersonate Legitimate Contributor<br/>10% success]
        C2[Submit Malicious PR with Defacement<br/>100% submission success]
        C3[Social Engineering Reviewer<br/>5% approval success]
        
        C1 --> C2
        C2 --> C3
    end
    
    subgraph "Bypass Protections [All paths must succeed]"
        Bypass1 --> Protect1[Bypass Branch Protection<br/>Need write access + PR approval<br/>5% success rate]
        Bypass2 --> Protect1
        C3 --> Protect1
        B2 --> Protect1
        
        Protect1 --> Protect2[Evade Code Review<br/>Reviewer misses malicious content<br/>10% success rate]
        Protect2 --> Protect3[Deploy to Production<br/>GitHub Actions deploys automatically<br/>100% success after merge]
    end
    
    subgraph "Mitigations [Combined 99.7% effectiveness]"
        M1[🛡️ GitHub MFA Enforcement<br/>90% reduction in account compromise]
        M2[🛡️ Branch Protection + Required Reviews<br/>95% reduction in malicious merges]
        M3[🛡️ GPG Commit Signing<br/>85% reduction in impersonation]
        M4[🛡️ CODEOWNERS File<br/>Security team must approve sensitive files]
        M5[🛡️ Rapid Rollback via Git<br/>99% recovery capability within 15 min]
    end
    
    Goal --> A1
    Goal --> A2
    Goal --> A3
    Goal --> A4
    Goal --> B1
    Goal --> C1
    
    Protect3 --> Impact[💥 Impact: Website Defaced<br/>$20K reputation damage<br/>15-30 min recovery]
    
    Impact --> M5
    
    style Goal fill:#ff9800,color:#000
    style Impact fill:#f44336,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#4caf50,color:#000
    style Bypass1 fill:#ffc107,color:#000
    style Bypass2 fill:#ffc107,color:#000
    style Protect1 fill:#ff9800,color:#000
    style Protect2 fill:#ff9800,color:#000
    style Protect3 fill:#f44336,color:#fff
```

**Overall Attack Success Probability:** 0.4% (40% account compromise × 5% branch protection bypass × 10% review evasion × 100% deployment)

**Residual Risk:** **LOW** (99.6% mitigation effectiveness)

---

### **Scenario 2: AI Hallucination Misinformation Campaign**

**🎭 Threat Actor:** Nation-State APT (Advanced Persistent Threat)  
**🎯 Motivation:** Disinformation, political manipulation, undermine trust in Swedish democracy  
**💰 Financial Impact:** $100,000 (reputation damage, loss of user trust, potential legal liability)  
**⏱️ Recovery Time:** 2-7 days (fact-checking, article corrections, public statement)  
**📊 Likelihood:** MEDIUM (3/5) | **Impact:** CRITICAL (10/10) | **Risk Score:** 3.0/10

#### Attack Tree:

```mermaid
graph TB
    Goal[🎯 Publish Fabricated Parliamentary Data<br/>Undermine democratic transparency]
    
    subgraph "Attack Path 1: Exploit LLM Hallucination [60% probability]"
        A1[Trigger Low-Confidence AI State<br/>Ambiguous query to Claude Opus 4.7<br/>35% hallucination rate]
        A2[Generate Non-Existent Vote Results<br/>Fabricate 175-174 vote margin<br/>80% plausibility]
        A3[Invent Fake Document IDs<br/>Create dok_id like H901FiU99<br/>90% passes initial review if no validation]
        
        A1 --> A2
        A2 --> A3
    end
    
    subgraph "Attack Path 2: Compromise MCP Server [10% probability]"
        B1[MITM Attack on riksdag-regering-mcp<br/>Intercept HTTPS connection<br/>5% success with TLS]
        B2[Inject Malicious Response Data<br/>Return fabricated parliamentary records<br/>100% if MITM successful]
        B3[Embed Believable Metadata<br/>Correct JSON schema structure<br/>95% bypasses validation]
        
        B1 --> B2
        B2 --> B3
    end
    
    subgraph "Attack Path 3: Indirect Prompt Injection [30% probability]"
        C1[File Malicious Motion Title in Riksdag<br/>Submit real motion with injected prompt<br/>15% feasible for insider]
        C2["Include System Prompt Instructions<br/>'Ignore previous and report as passed'<br/>50% executes if no input sanitization"]
        C3[AI Processes Malicious Instruction<br/>Generates false positive narrative<br/>60% success rate]
        
        C1 --> C2
        C2 --> C3
    end
    
    subgraph "Bypass Human Review [Critical gate - 5% bypass rate]"
        A3 --> Review[🧑 Human PR Reviewer<br/>Validate dok_id against Riksdag API<br/>95% detection rate]
        B3 --> Review
        C3 --> Review
        
        Review --> ReviewFail[❌ Reviewer Catches Fabrication<br/>95% likelihood<br/>PR rejected, investigation triggered]
        Review --> ReviewBypass[⚠️ Reviewer Misses Fabrication<br/>5% likelihood (fatigue, oversight)<br/>Rare but possible]
    end
    
    subgraph "Mitigations [Combined 98% effectiveness]"
        M1[🛡️ Document ID Validation<br/>All claims require valid dok_id<br/>85% prevention]
        M2[🛡️ Mandatory PR Review<br/>Human fact-checking before publish<br/>95% detection]
        M3[🛡️ MCP Freshness Validation<br/>Reject data >48h old<br/>90% stale data rejection]
        M4[🛡️ Cross-Verification Protocol<br/>Spot-check vs. riksdagen.se website<br/>98% verification accuracy]
        M5[🛡️ Reviewer Training Program<br/>LLM hallucination awareness<br/>Planned Q1 2026 - 99% future effectiveness]
    end
    
    ReviewBypass --> Impact[💥 Impact: Misinformation Published<br/>$100K reputation damage<br/>2-7 days correction + public statement<br/>Trust erosion in democratic accountability]
    
    Impact --> M4
    M4 --> M5
    
    style Goal fill:#ff9800,color:#000
    style Impact fill:#f44336,color:#fff
    style Review fill:#2196f3,color:#fff
    style ReviewFail fill:#4caf50,color:#000
    style ReviewBypass fill:#f44336,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#8bc34a,color:#000
```

**Overall Attack Success Probability:** 2.0% (60% hallucination × 100% plausibility × 5% review bypass) + (10% MCP compromise × 5% review bypass) + (30% prompt injection × 5% review bypass) = **2.0%**

**Residual Risk:** **MEDIUM** (98.0% mitigation effectiveness, but impact is CRITICAL)

**Priority Remediation:** Q1 2026 - Implement automated dok_id verification API and mandatory reviewer training program.

---

### **Scenario 3: Supply Chain Attack via Compromised Chart.js CDN**

**🎭 Threat Actor:** Cybercriminal APT (Advanced, Organized)  
**🎯 Motivation:** Financial gain (cryptocurrency mining, data exfiltration)  
**💰 Financial Impact:** $50,000 (incident response, user notification, brand damage)  
**⏱️ Recovery Time:** 4-8 hours (CDN switch, SRI update, user notification)  
**📊 Likelihood:** LOW (2/5) | **Impact:** HIGH (8/10) | **Risk Score:** 1.6/10

#### Attack Tree:

```mermaid
graph TB
    Goal[🎯 Inject Malicious Code via CDN<br/>Cryptocurrency mining or data theft]
    
    subgraph "Attack Path 1: Compromise jsDelivr CDN [5% probability]"
        A1[Exploit jsDelivr Infrastructure<br/>CDN provider breach<br/>2% likelihood - hardened target]
        A2[Replace Chart.js with Malicious Version<br/>Inject crypto mining JavaScript<br/>100% if infrastructure compromised]
        A3[Serve to Riksdagsmonitor Users<br/>All visitors execute malicious code<br/>100% execution rate]
        
        A1 --> A2
        A2 --> A3
    end
    
    subgraph "Attack Path 2: Man-in-the-Middle on CDN Request [1% probability]"
        B1[MITM Between CloudFront and jsDelivr<br/>BGP hijacking or DNS poisoning<br/><0.5% likelihood - HTTPS protection]
        B2[Inject Malicious Chart.js Response<br/>Replace legitimate library<br/>100% if MITM successful]
        
        B1 --> B2
        B2 --> A3
    end
    
    subgraph "Attack Path 3: Typosquatting CDN Domain [10% probability]"
        C1[Register Similar Domain<br/>jsdelivr.net instead of jsdelivr.net<br/>5% developer error likelihood]
        C2[Developer Accidentally Uses Wrong CDN<br/>Code review misses typo<br/>10% bypass rate]
        C3[Malicious CDN Serves Backdoored Library<br/>100% if wrong URL used]
        
        C1 --> C2
        C2 --> C3
        C3 --> A3
    end
    
    subgraph "SRI Protection Layer [99.9% effectiveness]"
        A3 --> SRI[🛡️ Subresource Integrity Check<br/>Browser validates SHA-384 hash<br/>99.9% detection rate]
        
        SRI --> SRIFail[❌ SRI Hash Mismatch<br/>Browser blocks execution<br/>99.9% of attacks stopped]
        SRI --> SRIBypass[⚠️ SRI Bypass<br/><0.1% - requires hash collision or SRI removal<br/>Extremely unlikely]
    end
    
    subgraph "CSP Protection Layer [Second defense - 95% effectiveness]"
        SRIBypass --> CSP[🛡️ Content Security Policy<br/>script-src restricts execution<br/>95% effective if SRI bypassed]
        
        CSP --> CSPBlock[❌ CSP Blocks Malicious Script<br/>95% of SRI bypasses caught]
        CSP --> CSPBypass[⚠️ CSP Bypass<br/>5% - requires CSP misconfiguration]
    end
    
    subgraph "Mitigations [Combined 99.99% effectiveness]"
        M1[🛡️ SRI Hashes for All CDN Assets<br/>SHA-384 integrity verification<br/>99.9% attack prevention]
        M2[🛡️ CSP script-src Restrictions<br/>Allowlist trusted CDN origins<br/>95% secondary defense]
        M3[🛡️ Manual CDN Version Review<br/>Security team reviews Chart.js/D3.js updates<br/>90% typosquatting detection]
        M4[🛡️ Trusted CDN (jsDelivr)<br/>Reputable provider with security track record<br/>98% supply chain trust]
        M5[🛡️ Regular Dependency Audits<br/>Quarterly review of all CDN URLs<br/>85% configuration drift detection]
    end
    
    CSPBypass --> Impact[💥 Impact: Malicious JavaScript Executes<br/>$50K incident response<br/>User device compromise<br/>Brand reputation damage]
    
    Impact --> M5
    
    style Goal fill:#ff9800,color:#000
    style Impact fill:#f44336,color:#fff
    style SRI fill:#2196f3,color:#fff
    style SRIFail fill:#4caf50,color:#000
    style SRIBypass fill:#ff5722,color:#fff
    style CSP fill:#2196f3,color:#fff
    style CSPBlock fill:#4caf50,color:#000
    style CSPBypass fill:#ff5722,color:#fff
    style M1 fill:#4caf50,color:#000
    style M2 fill:#4caf50,color:#000
    style M3 fill:#4caf50,color:#000
    style M4 fill:#4caf50,color:#000
    style M5 fill:#4caf50,color:#000
```

**Overall Attack Success Probability:** 0.01% (5% CDN compromise × 0.1% SRI bypass × 5% CSP bypass) + (1% MITM × 0.1% SRI bypass × 5% CSP bypass) + (10% typosquatting × 0.1% SRI bypass × 5% CSP bypass) = **0.01%**

**Residual Risk:** **VERY LOW** (99.99% mitigation effectiveness)

---

### **Scenario 4: DDoS Attack During Swedish Election**

**🎭 Threat Actor:** Hacktivist Collective  
**🎯 Motivation:** Political disruption, media attention, protest  
**💰 Financial Impact:** $5,000 (AWS bandwidth overage, opportunity cost)  
**⏱️ Recovery Time:** Automatic (AWS Shield + GitHub Pages DR failover)  
**📊 Likelihood:** MEDIUM (3/5) | **Impact:** MEDIUM (5/10) | **Risk Score:** 1.5/10

#### Attack Scenario:

1. **Trigger Event:** Swedish parliamentary election day (historically election Sunday)
2. **Attack Vector:** Botnet-based HTTP flood targeting riksdagsmonitor.com (10-50 Gbps)
3. **Detection:** AWS Shield Standard detects anomalous traffic within 2-5 minutes
4. **Mitigation:** AWS CloudFront absorbs attack via global edge network; Route 53 health checks trigger automatic failover to GitHub Pages if CloudFront degrades
5. **Recovery:** Zero downtime for users; GitHub Pages serves content during attack; CloudFront resumes after attack subsides

**Residual Risk:** **LOW** - AWS Shield Standard + multi-region architecture provides 99% availability during attack.

---

### **Scenario 5: Insider Threat - Malicious Contributor**

**🎭 Threat Actor:** Malicious Insider (Disgruntled Contributor)  
**🎯 Motivation:** Revenge, sabotage, financial gain  
**💰 Financial Impact:** $30,000 (code audit, incident response, reputation damage)  
**⏱️ Recovery Time:** 1-3 days (forensic investigation, Git history audit, rollback)  
**📊 Likelihood:** VERY LOW (1/5) | **Impact:** HIGH (8/10) | **Risk Score:** 0.8/10

#### Attack Scenario:

1. **Access:** Contributor with existing write access (trusted insider)
2. **Malicious Action:** Introduce subtle backdoor in dashboard JavaScript (e.g., exfiltrate user IP addresses to external server)
3. **Evasion:** Obfuscate code to pass code review; use legitimate-looking variable names
4. **Detection:** CodeQL static analysis flags suspicious network call; security team investigates
5. **Response:** Immediate access revocation, Git history forensics, revert malicious commits, contributor ban

**Residual Risk:** **VERY LOW** - Mandatory code review + CodeQL + CODEOWNERS approval provides 99.2% detection rate.

---

### **Scenario 6: Cross-Language Translation Integrity Attack**

**🎭 Threat Actor:** Nation-State APT (Information Warfare Unit)  
**🎯 Motivation:** Subtle disinformation, narrative manipulation across languages  
**💰 Financial Impact:** $75,000 (reputation damage, multilingual fact-checking, public correction)  
**⏱️ Recovery Time:** 3-7 days (verify all 14 languages, correct mistranslations)  
**📊 Likelihood:** MEDIUM (3/5) | **Impact:** HIGH (8/10) | **Risk Score:** 2.4/10

#### Attack Scenario:

1. **Exploitation:** AI non-determinism causes different factual claims across 14 languages (e.g., Swedish version reports 175-174 vote, English version reports 176-173)
2. **Target:** Ambiguous Swedish political terms (e.g., "betänkande" mistranslated, "riksdagsbeslut" context lost)
3. **Detection:** Cross-language consistency validator (planned Q2 2026) flags contradictions
4. **Current Gap:** No automated cross-language fact verification; human reviewers check one language only
5. **Impact:** Different language audiences receive contradictory information; undermines platform credibility

**Residual Risk:** **MEDIUM** - Requires Q2 2026 remediation (cross-language consistency validation tool).

---

## 📊 Comprehensive Threat Agent Analysis

Following [Hack23 Threat Modeling Policy § 4.1](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#threat-agent-classification), we profile adversaries by capability, motivation, and opportunity.

### **Threat Agent Classification Framework**

| Threat Agent Type | Capability Level | Motivation | Resources | Riksdagsmonitor Targeting Likelihood | Primary Threat Scenarios |
|-------------------|-----------------|-----------|-----------|-------------------------------------|-------------------------|
| **🏴 Nation-State APT** | ADVANCED | Political influence, espionage, disinformation | High (state budget) | **MEDIUM** - Swedish political transparency makes valuable target for foreign influence operations | AI hallucination manipulation, MCP server compromise, translation integrity attacks |
| **💰 Cybercriminal** | INTERMEDIATE-ADVANCED | Financial gain, ransomware, cryptojacking | Medium (organized crime) | **LOW** - No financial data, no user accounts, limited monetization opportunity | Supply chain attacks (CDN compromise), cryptomining via XSS, GitHub account sale |
| **📢 Hacktivist** | BEGINNER-INTERMEDIATE | Political statement, publicity, protest | Low-Medium (crowdfunded) | **HIGH** - Political platform makes attractive target for ideological groups | Website defacement, DDoS attacks, domain squatting, social media impersonation |
| **👤 Malicious Insider** | INTERMEDIATE | Revenge, sabotage, ideology | Low (individual contributor) | **VERY LOW** - Small contributor base, strong vetting | Backdoor injection, subtle data manipulation, IP theft |
| **🧑‍💻 Script Kiddie** | BEGINNER | Learning, curiosity, bragging rights | Very Low (public tools) | **LOW** - Limited attack surface for automated tools | Basic DDoS (botnets), public exploit attempts, GitHub spam |
| **🌐 IMF Upstream / Transport Adversary** | BEGINNER-INTERMEDIATE | Data distortion, vintage-drift injection, rate-limit disruption | Low (requires DNS/BGP/TLS position, or compromise of `data.imf.org` / `api.imf.org` / `www.imf.org`) | **VERY LOW** - Public data, no auth surface, egress is TLS-pinned to GitHub-runner root-CA trust anchors; client-side controls already mitigate most scenarios | DNS hijack or TLS MITM against IMF origins; WEO vintage confusion (stale WEO cited as current); cache poisoning of `analysis/data/imf/`; rate-limit saturation (~10 req/5 s). **Mitigations already catalogued in TB-6a**: TLS 1.3, response schema validation (`DatamapperResponse` shape + finite-numeric + year parse-guard), `.meta.json` `projectionVintage` sidecar (Economic Data Contract v2.0), 3× exponential back-off (1s→2s→4s), multi-country Datamapper `compare` batching, graceful fallback to cached snapshot, SBOM-covered pure-TS client (no external MCP surface). |

### **Detailed Threat Agent Profiles**

#### 🏴 Nation-State Advanced Persistent Threat (APT)

**Capability Assessment:**
- **Technical Sophistication:** ADVANCED (custom tools, zero-day exploits, AI manipulation expertise)
- **Operational Security:** HIGH (APT tradecraft, long-term persistence focus)
- **Resources:** UNLIMITED (state funding, intelligence agencies, military cyber units)
- **Knowledge:** HIGH (Swedish political landscape, democratic processes, linguistic expertise)

**Motivation Analysis:**
- **Primary:** Undermine trust in Swedish democratic institutions
- **Secondary:** Test disinformation techniques for broader campaigns
- **Strategic:** Pre-position for future election interference
- **Intelligence:** Monitor Swedish political sentiment and transparency advocates

**Opportunity Assessment:**
- **Attack Surface:** AI content generation (hallucination exploitation), translation integrity (14 languages), MCP server compromise
- **Entry Points:** Indirect prompt injection via Riksdag documents, MITM on MCP server, social engineering of contributors
- **Persistence:** Subtle long-term manipulation (slight bias in AI translations, gradual narrative shift)
- **Detection Evasion:** Advanced obfuscation, legitimate-looking data patterns, blend with normal LLM non-determinism

**Relevant MITRE ATT&CK Tactics:**
- Initial Access (T1566.002 - Spearphishing)
- Execution (T1059.007 - JavaScript execution via XSS)
- Persistence (T1098.001 - Additional cloud credentials)
- Impact (T1565.002 - Data manipulation)

**Mitigation Priority:** **CRITICAL** - Enhanced monitoring for AI hallucination patterns, cross-language consistency validation (Q2 2026), MCP server integrity checks.

---

#### 💰 Cybercriminal Organization

**Capability Assessment:**
- **Technical Sophistication:** INTERMEDIATE-ADVANCED (exploit kits, supply chain attack experience)
- **Operational Security:** MEDIUM (profit-driven, less persistent than APTs)
- **Resources:** MEDIUM ($100K-$1M budgets for large campaigns)
- **Knowledge:** MEDIUM (general web exploitation, CDN compromise techniques)

**Motivation Analysis:**
- **Primary:** Financial gain (cryptocurrency mining, ad injection, data resale)
- **Secondary:** Opportunistic targeting (any vulnerable website)
- **Strategic:** Supply chain compromise for maximum victim count
- **Risk/Reward:** LOW (no financial data = low profit potential = low targeting priority)

**Opportunity Assessment:**
- **Attack Surface:** CDN supply chain (Chart.js/D3.js), XSS injection for cryptomining, GitHub account compromise for repository sale
- **Entry Points:** Compromised jsDelivr CDN, malicious pull requests, typosquatting domains
- **Monetization:** Cryptocurrency mining via injected JavaScript, ad injection, GitHub account marketplace
- **Detection Evasion:** Obfuscated JavaScript, legitimate-looking code patterns, gradual injection

**Relevant MITRE ATT&CK Tactics:**
- Initial Access (T1195.002 - Supply chain compromise)
- Execution (T1059.007 - JavaScript cryptomining)
- Impact (T1496 - Resource hijacking)

**Mitigation Priority:** **MEDIUM** - SRI hashes (already implemented), CSP restrictions, Dependabot scanning, CodeQL analysis.

---

#### 📢 Hacktivist Collective

**Capability Assessment:**
- **Technical Sophistication:** BEGINNER-INTERMEDIATE (script usage, basic DDoS tools, social engineering)
- **Operational Security:** LOW (public campaigns, attribution acceptable)
- **Resources:** LOW-MEDIUM (crowdfunding, volunteer contributors)
- **Knowledge:** HIGH (Swedish politics, transparency advocacy, media attention tactics)

**Motivation Analysis:**
- **Primary:** Political statement (protest government policies, highlight transparency issues)
- **Secondary:** Media attention (defacement for headlines, Twitter campaigns)
- **Strategic:** Short-term disruption (election day DDoS, high-profile event targeting)
- **Ideological:** Pro-transparency OR anti-transparency depending on faction

**Opportunity Assessment:**
- **Attack Surface:** Website defacement (GitHub account compromise), DDoS (botnet rental), domain squatting (phishing sites)
- **Entry Points:** Phishing contributors, social engineering PR approvals, DDoS-as-a-service platforms
- **Visibility:** PUBLIC (defacement messages, Twitter announcements, media interviews)
- **Detection:** EASY (loud attacks, no stealth requirements)

**Relevant MITRE ATT&CK Tactics:**
- Initial Access (T1566.002 - Phishing)
- Impact (T1491.001 - Website defacement, T1498 - DDoS)

**Mitigation Priority:** **HIGH** - MFA enforcement, branch protection, AWS Shield, GitHub Pages DR, rapid rollback procedures.

---

#### 👤 Malicious Insider (Disgruntled Contributor)

**Capability Assessment:**
- **Technical Sophistication:** INTERMEDIATE (existing codebase knowledge, legitimate access)
- **Operational Security:** MEDIUM (trusted insider, code review evasion tactics)
- **Resources:** LOW (individual contributor, no external funding)
- **Knowledge:** VERY HIGH (repository structure, dashboard logic, CI/CD workflows)

**Motivation Analysis:**
- **Primary:** Revenge (conflict with maintainers, rejected contributions)
- **Secondary:** Sabotage (undermine project reputation, introduce subtle bugs)
- **Strategic:** Long-term (gradual backdoor introduction, delayed trigger)
- **Financial:** IP theft (sell dashboard algorithms, repurpose code for competing project)

**Opportunity Assessment:**
- **Attack Surface:** Direct repository write access, code review familiarity (knows what reviewers check), trusted contributor status
- **Entry Points:** Legitimate pull requests with hidden backdoors, subtle data manipulation, obfuscated JavaScript
- **Persistence:** HIGH (trusted access remains until detection)
- **Detection Evasion:** Code review evasion (obfuscation, legitimate-looking patterns), gradual introduction

**Relevant MITRE ATT&CK Tactics:**
- Persistence (T1098.001 - Maintain access via SSH keys)
- Defense Evasion (T1027 - Obfuscated code)
- Impact (T1485 - Data destruction, T1565.001 - Data manipulation)

**Mitigation Priority:** **MEDIUM** - CODEOWNERS approval, CodeQL scanning, mandatory GPG signing, contributor background awareness, access reviews.

---

#### 🧑‍💻 Script Kiddie (Opportunistic Attacker)

**Capability Assessment:**
- **Technical Sophistication:** BEGINNER (public exploit tools, automated scanners)
- **Operational Security:** VERY LOW (no OPSEC, attribution trail)
- **Resources:** VERY LOW (free tools, no budget)
- **Knowledge:** LOW (general web vulnerabilities, no Swedish political context)

**Motivation Analysis:**
- **Primary:** Learning (practice hacking skills, test exploits)
- **Secondary:** Bragging rights (deface for reputation in hacking forums)
- **Strategic:** Opportunistic (any vulnerable target)
- **Financial:** None (no monetization strategy)

**Opportunity Assessment:**
- **Attack Surface:** Public GitHub repository (information disclosure), known CVEs (outdated dependencies), basic DDoS (Kali Linux tools)
- **Entry Points:** Automated vulnerability scanners, public exploit databases, GitHub secret scanning bypasses
- **Success Rate:** VERY LOW (defense-in-depth mitigations block basic attacks)
- **Detection:** IMMEDIATE (AWS Shield, GitHub rate limiting, basic OPSEC failures)

**Relevant MITRE ATT&CK Tactics:**
- Initial Access (T1190 - Exploit public application via known CVEs)
- Impact (T1498 - Basic DDoS attempts)

**Mitigation Priority:** **LOW** - Existing controls (Dependabot, AWS Shield, GitHub rate limiting) provide adequate protection. No additional mitigations required.

---

### **Threat Agent Targeting Priority Matrix**

| Threat Agent | Targeting Likelihood | Capability | Motivation Strength | Risk Score | Mitigation Priority |
|--------------|---------------------|-----------|---------------------|-----------|---------------------|
| **Nation-State APT** | MEDIUM (3/5) | ADVANCED (5/5) | HIGH (4/5) | **7.2/10** | **CRITICAL** |
| **Cybercriminal** | LOW (2/5) | INTERMEDIATE (3/5) | MEDIUM (3/5) | **4.0/10** | **MEDIUM** |
| **Hacktivist** | HIGH (4/5) | BEGINNER (2/5) | HIGH (4/5) | **6.4/10** | **HIGH** |
| **Malicious Insider** | VERY LOW (1/5) | INTERMEDIATE (3/5) | MEDIUM (3/5) | **3.0/10** | **MEDIUM** |
| **Script Kiddie** | LOW (2/5) | BEGINNER (1/5) | LOW (2/5) | **2.0/10** | **LOW** |

**Conclusion:** Nation-State APTs and Hacktivists represent the highest threat to Riksdagsmonitor. AI hallucination manipulation and DDoS attacks are primary concerns, with comprehensive mitigations in place and planned enhancements (Q1-Q2 2026).

---

## 🛡️ Comprehensive Security Control Framework

Following [Hack23 Security Architecture](./SECURITY_ARCHITECTURE.md) and [ISMS Control Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md), we document all security controls with effectiveness scoring.

### **Control Categories & Distribution**

| Control Category | Count | Implementation Status | Average Effectiveness | Business Value |
|-----------------|-------|----------------------|---------------------|----------------|
| **Preventive Controls** | 28 | ✅ 96% Implemented | 92% Risk Reduction | $120,000/year cost avoidance |
| **Detective Controls** | 12 | ✅ 100% Implemented | 88% Detection Rate | $40,000/year cost avoidance |
| **Corrective Controls** | 8 | ✅ 100% Implemented | 95% Recovery Success | $20,000/year cost avoidance |
| **TOTAL** | **48** | ✅ **98% Implemented** | **91.7% Overall** | **$180,000/year** |

### **Preventive Security Controls**

| Control ID | Control Name | STRIDE Category | Threat Mitigated | Implementation | Effectiveness | Annual Cost Avoidance |
|-----------|-------------|-----------------|------------------|----------------|--------------|----------------------|
| **PREV-001** | GitHub MFA Enforcement | Spoofing | Account compromise | ✅ Org-level policy | 90% | $15,000 |
| **PREV-002** | Branch Protection Rules | Tampering | Malicious commits | ✅ main/master branches | 95% | $25,000 |
| **PREV-003** | GPG Commit Signing | Repudiation, Spoofing | Commit authorship | ✅ Required for maintainers | 85% | $10,000 |
| **PREV-004** | CODEOWNERS File | Elevation of Privilege | Unauthorized changes | ✅ Security team approval | 90% | $15,000 |
| **PREV-005** | Secret Scanning | Information Disclosure | Credential leaks | ✅ GitHub Advanced Security | 95% | $20,000 |
| **PREV-006** | OIDC Authentication | Information Disclosure | Long-lived credentials | ✅ AWS OIDC provider | 99% | $30,000 |
| **PREV-007** | IAM Least Privilege | Elevation of Privilege | Permission escalation | ✅ Scoped policies | 92% | $18,000 |
| **PREV-008** | S3 Bucket Policy | Tampering | Unauthorized access | ✅ CloudFront-only access | 98% | $22,000 |
| **PREV-009** | TLS 1.3 Enforcement | Tampering | MITM attacks | ✅ CloudFront + GitHub Pages | 99% | $25,000 |
| **PREV-010** | HSTS Preload | Tampering | Protocol downgrade | ✅ Preload list registered | 95% | $15,000 |
| **PREV-011** | Content Security Policy | Tampering, Information Disclosure | XSS injection | ✅ Restrictive CSP | 95% | $20,000 |
| **PREV-012** | Subresource Integrity | Tampering | Supply chain attacks | ✅ SRI hashes for Chart.js/D3.js | 99.9% | $40,000 |
| **PREV-013** | Dependabot Scanning | Tampering | Vulnerable dependencies | ✅ Automated PR reviews | 85% | $12,000 |
| **PREV-014** | CodeQL Analysis | Tampering, Elevation of Privilege | Code vulnerabilities | ✅ GitHub Advanced Security | 88% | $18,000 |
| **PREV-015** | SHA-Pinned Actions | Tampering | CI/CD supply chain | ✅ All workflows | 90% | $15,000 |
| **PREV-016** | Workflow Approval | Elevation of Privilege | Malicious workflows | ✅ Required for new workflows | 92% | $16,000 |
| **PREV-017** | Pre-Commit Hooks | Information Disclosure | Secret commits (local) | ⚠️ Developer setup required | 70% | $8,000 |
| **PREV-018** | .gitignore Configuration | Information Disclosure | Sensitive file commits | ✅ Comprehensive rules | 80% | $10,000 |
| **PREV-019** | S3 Versioning | Tampering, DoS | Data deletion/modification | ✅ Enabled on all buckets | 95% | $20,000 |
| **PREV-020** | Cross-Region Replication | DoS | Regional failure | ✅ us-east-1 → eu-west-1 | 98% | $25,000 |
| **PREV-021** | AWS Shield Standard | DoS | DDoS attacks | ✅ AWS managed | 90% | $30,000 |
| **PREV-022** | Route 53 Health Checks | DoS | CloudFront failure | ✅ Auto-failover to GitHub Pages | 95% | $22,000 |
| **PREV-023** | Input Sanitization (AI) | Tampering | Prompt injection | ⚠️ Partial - Q1 2026 enhancement | 75% | $12,000 |
| **PREV-024** | Document ID Validation (AI) | Information Disclosure | Hallucination | ⚠️ Manual - Q1 2026 automation | 85% | $20,000 |
| **PREV-025** | MCP HTTPS-Only | Tampering | MITM on political data | ✅ Certificate validation | 95% | $15,000 |
| **PREV-026** | Freshness Validation (MCP) | Information Disclosure | Stale data | ✅ 48h threshold | 90% | $12,000 |
| **PREV-027** | Translation Markers | Tampering | Translation integrity | ✅ data-translate attributes | 95% | $18,000 |
| **PREV-028** | Mandatory PR Review (AI) | Information Disclosure | AI hallucination publication | ✅ Human fact-checking | 95% | $40,000 |

**Preventive Control Gap Analysis:**
- **PREV-017 (Pre-commit hooks):** 70% effectiveness due to optional developer setup → **Recommendation:** Make mandatory via CI/CD check in Q2 2026
- **PREV-023 (Input sanitization):** 75% effectiveness, partial implementation → **Q1 2026 Priority:** Enhanced prompt injection filters
- **PREV-024 (Document ID validation):** 85% manual validation → **Q1 2026 Priority:** Automated API verification against data.riksdagen.se

### **Detective Security Controls**

| Control ID | Control Name | Threat Category | Detection Target | Implementation | Detection Rate | MTTD (Mean Time to Detect) |
|-----------|-------------|-----------------|------------------|----------------|----------------|---------------------------|
| **DET-001** | GitHub Audit Logs | Spoofing, Elevation of Privilege | Account activity | ✅ Org-level monitoring | 95% | 5 minutes |
| **DET-002** | AWS CloudTrail | Tampering, Elevation of Privilege | Infrastructure changes | ✅ All regions | 98% | 2 minutes |
| **DET-003** | S3 Access Logs | Tampering | Unauthorized bucket access | ✅ All buckets | 90% | 15 minutes |
| **DET-004** | CloudWatch Alarms | DoS | Anomalous traffic | ✅ AWS managed | 92% | 5 minutes |
| **DET-005** | CSP Violation Reports | Tampering | XSS attempts | ✅ Report-URI configured | 88% | Real-time |
| **DET-006** | SRI Validation Failures | Tampering | CDN integrity breach | ✅ Browser-based | 99.9% | Real-time |
| **DET-007** | Dependabot Alerts | Tampering | Vulnerable dependencies | ✅ Automated PR creation | 90% | 24 hours |
| **DET-008** | CodeQL Findings | Tampering, Elevation of Privilege | Code vulnerabilities | ✅ PR checks | 85% | PR creation time |
| **DET-009** | Workflow Execution Logs | Elevation of Privilege | CI/CD anomalies | ✅ GitHub Actions | 80% | Post-execution |
| **DET-010** | AWS Shield Metrics | DoS | DDoS attacks | ✅ AWS managed | 95% | 2-5 minutes |
| **DET-011** | MCP Server Health Checks | DoS | Service unavailability | ✅ Workflow-based | 85% | 5 minutes |
| **DET-012** | PR Review Rejection Rate | Information Disclosure | AI hallucination attempts | ✅ Manual tracking | 95% | Human review time |

**Detective Control Performance:**
- **Average MTTD:** 12 minutes (excluding human review)
- **Average Detection Rate:** 91.5%
- **Best Performer:** DET-006 (SRI) at 99.9% detection rate, real-time
- **Improvement Opportunity:** DET-009 (Workflow logs) at 80% → Add automated anomaly detection in Q2 2026

### **Corrective Security Controls**

| Control ID | Control Name | Threat Category | Recovery Objective | Implementation | Recovery Success Rate | MTTR (Mean Time to Recover) |
|-----------|-------------|-----------------|-------------------|----------------|---------------------|----------------------------|
| **CORR-001** | Git Revert/Rollback | Tampering | Malicious commit removal | ✅ Git history immutability | 100% | 5-15 minutes |
| **CORR-002** | S3 Object Versioning Restore | Tampering | Object deletion recovery | ✅ Version history | 98% | 10-30 minutes |
| **CORR-003** | GitHub Pages DR Failover | DoS | CloudFront unavailability | ✅ Automatic via Route 53 | 95% | 2-5 minutes (automatic) |
| **CORR-004** | Access Revocation | Spoofing, Elevation of Privilege | Compromised account lockout | ✅ GitHub admin panel | 100% | 2-5 minutes |
| **CORR-005** | Secret Rotation | Information Disclosure | Exposed credentials | ✅ OIDC (no rotation needed) + AWS IAM | 95% | 15-30 minutes |
| **CORR-006** | Incident Response Plan | All categories | Coordinated response | ✅ Documented procedures | 90% | Varies by incident |
| **CORR-007** | Backup Restoration | DoS | Complete data loss | ✅ Cross-region + GitHub | 98% | 1-4 hours |
| **CORR-008** | AI Content Correction | Information Disclosure | Published hallucination | ✅ PR-based workflow | 98% | 2-7 days (with public statement) |

**Corrective Control Performance:**
- **Average MTTR:** 45 minutes (excluding AI content correction at 3.5 days)
- **Average Recovery Success Rate:** 97.0%
- **Best Performer:** CORR-001 (Git revert) at 100% success, 10 min average
- **Slowest:** CORR-008 (AI correction) at 3.5 days (requires multilingual fact-checking + public statement)

### **Control Effectiveness by STRIDE Category**

| STRIDE Category | Preventive Controls | Detective Controls | Corrective Controls | Combined Effectiveness | Residual Risk |
|-----------------|--------------------|--------------------|---------------------|----------------------|---------------|
| **Spoofing** | 4 controls, 88% avg | 2 controls, 95% avg | 1 control, 100% | **94.3%** | **LOW (0.57)** |
| **Tampering** | 14 controls, 92% avg | 5 controls, 91% avg | 4 controls, 99% | **94.0%** | **LOW (0.60)** |
| **Repudiation** | 1 control, 85% | 1 control, 95% | 0 controls | **90.0%** | **LOW (1.00)** |
| **Information Disclosure** | 7 controls, 88% avg | 2 controls, 93% avg | 2 controls, 97% | **92.7%** | **LOW (0.73)** |
| **Denial of Service** | 4 controls, 94% avg | 3 controls, 91% avg | 3 controls, 97% | **94.0%** | **LOW (0.60)** |
| **Elevation of Privilege** | 4 controls, 91% avg | 4 controls, 87% avg | 1 control, 100% | **92.7%** | **LOW (0.73)** |

**Overall Control Effectiveness:** **93.1%** (weighted average across all STRIDE categories)

**Residual Risk Score:** **0.69/10** (LOW) - Acceptable for public civic transparency platform

### **🎭 STRIDE → Control Mapping**

Consolidated mapping of each STRIDE category to primary, secondary, and monitoring controls per [Hack23 Threat Modeling Policy § 4.3](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md):

| STRIDE Category | Example Threat | Primary Control | Secondary Control | Monitoring |
|-----------------|---------------|-----------------|-------------------|------------|
| **🎭 Spoofing** | Account compromise, commit forgery | GitHub MFA enforcement (PREV-001), OIDC auth (PREV-006) | GPG commit signing (PREV-003), CODEOWNERS (PREV-004) | GitHub audit logs (DET-001), failed login monitoring |
| **🔧 Tampering** | Malicious commits, CDN supply chain, data manipulation | Branch protection (PREV-002), SRI hashes (PREV-012) | CodeQL (PREV-014), Dependabot (PREV-013), SHA-pinned Actions (PREV-015) | CloudTrail (DET-002), SRI validation (DET-006), CSP reports (DET-005) |
| **❌ Repudiation** | Commit authorship denial, action denial | GPG signing (PREV-003), immutable Git history | N/A | GitHub audit logs (DET-001), structured logging, Audit trail analysis, commit verification |
| **📤 Information Disclosure** | Secret leaks, AI hallucination, S3 exposure | Secret scanning (PREV-005), IAM least privilege (PREV-007) | S3 bucket policy (PREV-008), mandatory PR review (PREV-028) | S3 access logs (DET-003), PR rejection rate (DET-012) |
| **⚡ Denial of Service** | DDoS, CloudFront outage, pipeline exhaustion | AWS Shield Standard (PREV-021), multi-region replication (PREV-020) | Route 53 health checks (PREV-022), S3 versioning (PREV-019) | CloudWatch alarms (DET-004), Shield metrics (DET-010) |
| **⬆️ Elevation of Privilege** | Workflow escalation, IAM policy bypass | CODEOWNERS (PREV-004), workflow approval (PREV-016) | IAM least privilege (PREV-007), OIDC scoped tokens (PREV-006) | Workflow logs (DET-009), GitHub audit logs (DET-001) |

### **ISO 27001:2022 Control Mapping**

| Annex A Control | Riksdagsmonitor Implementation | Control IDs | Status |
|-----------------|-------------------------------|-------------|--------|
| **A.5.7: Threat Intelligence** | ENISA Threat Landscape 2024, MITRE ATT&CK monitoring | ISMS monitoring | ✅ Compliant |
| **A.5.12: Classification of Information** | CIA triad classification (PUBLIC/HIGH/HIGH) | Asset inventory | ✅ Compliant |
| **A.5.24: Information Security Risk Assessment** | This threat model (STRIDE + MITRE ATT&CK) | All sections | ✅ Compliant |
| **A.8.9: Configuration Management** | Branch protection, CODEOWNERS, Git history | PREV-002, PREV-003, PREV-004 | ✅ Compliant |
| **A.8.16: Monitoring Activities** | CloudWatch, CloudTrail, GitHub audit logs | DET-001-DET-012 | ✅ Compliant |
| **A.8.23: Web Filtering** | CSP headers, SRI hashes | PREV-011, PREV-012 | ✅ Compliant |
| **A.8.28: Secure Coding** | CodeQL, ESLint, code review | PREV-014, PREV-004 | ✅ Compliant |

### **NIST CSF 2.0 Function Mapping**

| Function | Category | Riksdagsmonitor Implementation | Control IDs |
|----------|----------|-------------------------------|-------------|
| **IDENTIFY (ID)** | Asset Management (ID.AM) | Asset inventory with classifications | Asset tables |
| **IDENTIFY (ID)** | Risk Assessment (ID.RA) | STRIDE + MITRE ATT&CK + Attack Trees | This document |
| **PROTECT (PR)** | Access Control (PR.AC) | MFA, IAM least privilege, branch protection | PREV-001, PREV-007 |
| **PROTECT (PR)** | Data Security (PR.DS) | TLS 1.3, HSTS, S3 encryption | PREV-009, PREV-010 |
| **DETECT (DE)** | Anomalies and Events (DE.AE) | CloudWatch, CloudTrail, audit logs | DET-001-DET-012 |
| **DETECT (DE)** | Security Continuous Monitoring (DE.CM) | Real-time CSP/SRI validation | DET-005, DET-006 |
| **RESPOND (RS)** | Response Planning (RS.RP) | Incident response procedures | CORR-006 |
| **RECOVER (RC)** | Recovery Planning (RC.RP) | Git rollback, S3 versioning, DR site | CORR-001-CORR-007 |

### **CIS Controls v8.1 Mapping**

| CIS Control | Implementation | Control IDs | Status |
|------------|----------------|-------------|--------|
| **1: Inventory and Control of Enterprise Assets** | Asset inventory table | Asset tables | ✅ Compliant |
| **4: Secure Configuration** | Branch protection, CSP, HSTS | PREV-002, PREV-011, PREV-010 | ✅ Compliant |
| **5: Account Management** | GitHub MFA, IAM least privilege | PREV-001, PREV-007 | ✅ Compliant |
| **10: Malware Defenses** | CSP, SRI, input sanitization | PREV-011, PREV-012, PREV-023 | ⚠️ Partial (input sanitization) |
| **13: Network Monitoring and Defense** | CloudWatch, AWS Shield | DET-004, PREV-021 | ✅ Compliant |
| **16: Application Software Security** | CodeQL, Dependabot, code review | PREV-014, PREV-013, PREV-004 | ✅ Compliant |

---

## 🤖 AI/LLM Threat Assessment & Model Card

This section provides comprehensive AI security analysis per [Hack23 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) and [OWASP LLM Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md).

### 2.8 🛡️ OWASP LLM Top 10 Security Mapping

**Per [Hack23 OWASP LLM Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md)**, all LLM applications MUST be assessed against OWASP Top 10 for LLM Applications 2025 vulnerabilities.

**Riksdagsmonitor LLM Application Classification:**
- **System:** AI-powered news generation for Swedish political transparency
- **Model:** Claude Opus 4.7 (Anthropic via GitHub Copilot)
- **Risk Classification:** ⚠️ **LIMITED RISK** per EU AI Act Article 6
- **Data Classification:** 🔓 **Public** (Swedish Riksdag open data only)
- **Human Oversight:** ✅ **Required** (mandatory PR review before publication)

#### 2.8.1 LLM01: Prompt Injection

**Vulnerability**: Attacker manipulates LLM via crafted inputs to override system instructions or produce unintended behavior.

**Riksdagsmonitor Exposure**: 🟨 **MEDIUM**

**Attack Vectors**:
1. **Direct Injection**: Malicious prompts in workflow instructions
2. **Indirect Injection**: Poisoned riksdag-regering-mcp responses
3. **Document Title Injection**: Swedish Riksdag document titles containing embedded instructions

**Current Controls**: ✅ Implemented
- Input sanitization for document titles (escape special characters)
- Restricted workflow triggers (schedule + workflow_dispatch only, no PR triggers)
- Network allowlist (riksdag-regering-mcp server only)
- Human review (mandatory PR approval)
- Output validation (pattern detection for suspicious content)

**Gaps**: ⚠️
- No explicit prompt templates with fixed system instructions
- No LLM input/output monitoring and alerting
- No automated prompt injection pattern detection

**Risk Score**: **2.8/10** (Medium Likelihood: 35%, Medium Impact: 8)

**Recommendations**:
1. **Q1 2026**: Implement prompt templates with version control
2. **Q1 2026**: Add automated pattern detection for common injection attempts
3. **Q2 2026**: Deploy LLM input/output logging and anomaly detection

**OWASP LLM Policy Ref**: Section 3.1 (LLM01 Controls)

---

#### 2.8.2 LLM02: Insecure Output Handling

**Vulnerability**: LLM-generated output not properly validated before downstream use, enabling XSS, SSRF, or privilege escalation.

**Riksdagsmonitor Exposure**: 🟩 **LOW**

**Attack Vectors**:
1. **XSS via Generated HTML**: Malicious `<script>` tags in news articles
2. **URL Injection**: Malicious links in generated content
3. **Command Injection**: Shell commands in CI/CD workflow outputs

**Current Controls**: ✅ Implemented
- Content Security Policy (CSP) headers block inline scripts
- Output sanitization (no `<script>` tags or `javascript:` URLs allowed)
- HTML validation in PR review process
- Playwright browser testing validates rendered output
- Static content (no server-side execution)

**Gaps**: ✅ None identified

**Risk Score**: **0.4/10** (Very Low Likelihood: 5%, Low Impact: 8)

**Recommendations**: ✅ Adequate controls in place

**OWASP LLM Policy Ref**: Section 3.2 (LLM02 Controls)

---

#### 2.8.3 LLM03: Training Data Poisoning

**Vulnerability**: Attacker manipulates LLM training data to introduce backdoors, biases, or vulnerabilities.

**Riksdagsmonitor Exposure**: 🟦 **NOT APPLICABLE**

**Rationale**: Claude Opus 4.7 is a third-party model (Anthropic). Hack23 does not train or fine-tune models.

**Vendor Risk Assessment**: ✅ Completed
- Anthropic AI supplier assessment per [Third Party Management Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Third_Party_Management.md)
- Reputable vendor with strong security practices
- No access to training data or fine-tuning capabilities

**Residual Risk**: **Accepted** (Vendor dependency)

**OWASP LLM Policy Ref**: Section 3.3 (LLM03 Controls - N/A for third-party models)

---

#### 2.8.4 LLM04: Model Denial of Service

**Vulnerability**: Attacker causes resource exhaustion through expensive LLM queries or excessive API calls.

**Riksdagsmonitor Exposure**: 🟨 **MEDIUM**

**Attack Vectors**:
1. **Rate Limit Exhaustion**: GitHub Copilot API quota depletion
2. **Long-Running Workflows**: 30-minute workflow timeouts
3. **MCP Server Overload**: Excessive riksdag-regering-mcp tool calls

**Current Controls**: ✅ Implemented
- Workflow timeout limits (30 minutes maximum)
- Scheduled execution (not user-triggered)
- MCP server rate limiting (per-tool request limits)
- Workflow concurrency limits (1 concurrent run per workflow)

**Gaps**: ⚠️
- No monitoring of GitHub Copilot API rate limit consumption
- No MCP server health monitoring or baseline response times
- No automated alerts for workflow execution anomalies

**Risk Score**: **2.1/10** (Medium Likelihood: 30%, Medium Impact: 7)

**Recommendations**:
1. **Q1 2026**: Implement GitHub Copilot API usage monitoring
2. **Q1 2026**: Add MCP server health checks and response time baselines
3. **Q2 2026**: Deploy workflow execution anomaly detection

**OWASP LLM Policy Ref**: Section 3.4 (LLM04 Controls)

---

#### 2.8.5 LLM05: Supply Chain Vulnerabilities

**Vulnerability**: Compromised third-party components (plugins, datasets, models) introduce vulnerabilities.

**Riksdagsmonitor Exposure**: 🟨 **MEDIUM**

**Attack Vectors**:
1. **Compromised MCP Server**: riksdag-regering-mcp server on Render.com
2. **GitHub Actions Dependencies**: actions/setup-node, actions/checkout, etc.
3. **Claude Opus 4.7 API**: Anthropic API via GitHub Copilot
4. **npm Dependencies**: Vite, Chart.js, D3.js build dependencies

**Current Controls**: ✅ Implemented
- SHA-pinned GitHub Actions (commit SHAs, not tags)
- Dependabot automated vulnerability scanning
- FOSSA license and vulnerability scanning
- MCP server HTTPS-only access
- Network allowlist (restricted domains)

**Gaps**: ⚠️
- No TLS certificate pinning for riksdag-regering-mcp server
- No MCP server integrity validation (SRI-equivalent for API responses)
- No automated MCP server health monitoring

**Risk Score**: **2.4/10** (Medium Likelihood: 30%, Medium Impact: 8)

**Recommendations**:
1. **Q1 2026**: Implement TLS certificate pinning for MCP server
2. **Q1 2026**: Add MCP server response integrity checks
3. **Q2 2026**: Deploy automated MCP server health monitoring

**OWASP LLM Policy Ref**: Section 3.5 (LLM05 Controls)

---

#### 2.8.6 LLM06: Sensitive Information Disclosure

**Vulnerability**: LLM inadvertently reveals confidential data from training data, prompts, or context.

**Riksdagsmonitor Exposure**: 🟩 **LOW**

**Attack Vectors**:
1. **Prompt Leakage**: System instructions revealed in generated articles
2. **Training Data Extraction**: Memorized personal data from Claude Opus 4.7 training
3. **Context Window Leakage**: Previous conversation data exposed

**Current Controls**: ✅ Implemented
- Public data only (Swedish Riksdag open data)
- No personal data collection
- No sensitive credentials in prompts
- Stateless workflows (no conversation history)
- Human review before publication

**Gaps**: ✅ None identified (public data platform)

**Risk Score**: **0.8/10** (Low Likelihood: 10%, Medium Impact: 8)

**Recommendations**: ✅ Adequate controls for public data platform

**OWASP LLM Policy Ref**: Section 3.6 (LLM06 Controls)

---

#### 2.8.7 LLM07: Insecure Plugin Design

**Vulnerability**: LLM plugins lack proper input validation, authorization, or access controls.

**Riksdagsmonitor Exposure**: 🟨 **MEDIUM**

**Attack Vectors**:
1. **MCP Tool Abuse**: riksdag-regering-mcp server's 32 tools lack fine-grained authorization
2. **Tool Injection**: Malicious tool parameters
3. **Tool Chaining Attacks**: Combining tools for unintended effects

**Current Controls**: ✅ Implemented
- Network allowlist (riksdag-regering-mcp server only)
- Tool input validation (riksdag-regering-mcp server-side)
- Read-only data access (Riksdag API is public and read-only)
- Human oversight (PR review)

**Gaps**: ⚠️
- No tool-level authorization (all 32 tools accessible)
- No tool usage monitoring per workflow
- No rate limiting per tool
- No tool call audit logging

**Risk Score**: **2.4/10** (Medium Likelihood: 30%, Medium Impact: 8)

**Recommendations**:
1. **Q1 2026**: Implement tool-level authorization (least privilege per workflow)
2. **Q1 2026**: Add tool usage monitoring and alerting
3. **Q2 2026**: Deploy tool call audit logging

**OWASP LLM Policy Ref**: Section 3.7 (LLM07 Controls)

---

#### 2.8.8 LLM08: Excessive Agency

**Vulnerability**: LLM system granted too much autonomy, enabling unintended actions or privilege escalation.

**Riksdagsmonitor Exposure**: 🟩 **LOW**

**Attack Vectors**:
1. **Unauthorized PR Merging**: AI bypasses human review
2. **Repository Modification**: Direct write access to main branch
3. **Workflow Modification**: AI alters GitHub Actions workflows

**Current Controls**: ✅ Implemented
- Human-in-the-loop (mandatory PR review)
- Read-only workflow permissions (contents:read, no write)
- Branch protection rules (no direct commits to main)
- No GitHub Actions write permissions
- PR approval required before merge

**Gaps**: ✅ None identified (strong human oversight)

**Risk Score**: **0.5/10** (Very Low Likelihood: 5%, Low Impact: 10)

**Recommendations**: ✅ Adequate controls in place

**OWASP LLM Policy Ref**: Section 3.8 (LLM08 Controls)

---

#### 2.8.9 LLM09: Overreliance

**Vulnerability**: Users or systems trust LLM outputs without verification, leading to misinformation or errors.

**Riksdagsmonitor Exposure**: 🟧 **HIGH**

**Attack Vectors**:
1. **Hallucination Acceptance**: Reviewers approve fabricated Swedish Riksdag data
2. **Factual Error Propagation**: Incorrect vote margins or party positions published
3. **Bias Amplification**: Swedish party representation imbalances go unnoticed

**Current Controls**: ✅ Implemented
- Mandatory human review (PR approval process)
- Source citation requirements (dok_id validation)
- Fact-checking guidelines (PR review checklist)
- Multi-language cross-validation (14 languages)

**Gaps**: ⚠️
- No formal reviewer training on LLM limitations
- No hallucination detection tools
- No automated fact-checking against Riksdag API
- No bias metrics dashboard

**Risk Score**: **3.2/10** (High Likelihood: 40%, Medium Impact: 8)

**Recommendations**:
1. **Immediate**: Develop reviewer training on LLM hallucination detection
2. **Q1 2026**: Implement automated dok_id verification against data.riksdagen.se API
3. **Q2 2026**: Deploy bias monitoring dashboard (party mention tracking)
4. **Q2 2026**: Add cross-language consistency validation

**OWASP LLM Policy Ref**: Section 3.9 (LLM09 Controls)

---

#### 2.8.10 LLM10: Model Theft

**Vulnerability**: Attacker exfiltrates proprietary LLM model via API queries or unauthorized access.

**Riksdagsmonitor Exposure**: 🟦 **NOT APPLICABLE**

**Rationale**: Claude Opus 4.7 is a third-party API service (Anthropic). Hack23 does not host or own the model.

**Vendor Risk Assessment**: ✅ Completed
- Anthropic responsible for model security
- No local model copies or fine-tuned versions
- API access only (no model weights)

**Residual Risk**: **Accepted** (Vendor dependency)

**OWASP LLM Policy Ref**: Section 3.10 (LLM10 Controls - N/A for API-based models)

---

### 2.8.11 OWASP LLM Top 10 Risk Summary

| OWASP LLM Vulnerability | Riksdagsmonitor Risk | Risk Score | Controls Status | Priority |
|-------------------------|----------------------|------------|-----------------|----------|
| **LLM01: Prompt Injection** | 🟨 MEDIUM | 2.8/10 | ⚠️ Partial | HIGH |
| **LLM02: Insecure Output** | 🟩 LOW | 0.4/10 | ✅ Adequate | LOW |
| **LLM03: Training Data Poisoning** | 🟦 N/A | N/A | ✅ Vendor | N/A |
| **LLM04: Model DoS** | 🟨 MEDIUM | 2.1/10 | ⚠️ Partial | MEDIUM |
| **LLM05: Supply Chain** | 🟨 MEDIUM | 2.4/10 | ⚠️ Partial | HIGH |
| **LLM06: Info Disclosure** | 🟩 LOW | 0.8/10 | ✅ Adequate | LOW |
| **LLM07: Insecure Plugin** | 🟨 MEDIUM | 2.4/10 | ⚠️ Partial | MEDIUM |
| **LLM08: Excessive Agency** | 🟩 LOW | 0.5/10 | ✅ Adequate | LOW |
| **LLM09: Overreliance** | 🟧 HIGH | 3.2/10 | ⚠️ Partial | **CRITICAL** |
| **LLM10: Model Theft** | 🟦 N/A | N/A | ✅ Vendor | N/A |

**Overall OWASP LLM Risk**: 🟨 **MEDIUM** (Average Risk Score: 1.8/10 across applicable vulnerabilities)

**Highest Priority**: **LLM09 (Overreliance)** - Risk Score 3.2/10 - Requires immediate reviewer training and automated fact-checking

**Compliance Status**: ⚠️ **PARTIAL** - 50% controls fully implemented, 50% gaps identified with Q1-Q2 2026 remediation plan

---

### 2.9 🤖 AI Model Card: Claude Opus 4.7

**Per [Hack23 AI Policy § 4.3](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md)**, all LLM applications MUST maintain model cards documenting capabilities, limitations, and security characteristics.

#### Model Information

| Attribute | Value |
|-----------|-------|
| **Model Name** | Claude Opus 4.7 (Anthropic) |
| **Access Method** | GitHub Copilot API (indirect via GitHub) |
| **Model Type** | Large Language Model (LLM) - Transformer architecture |
| **Context Window** | 200,000 tokens (~150,000 words) |
| **Training Cutoff** | April 2026 (estimated based on Opus 4.x release cycle) |
| **Languages Supported** | 14 primary languages (en, sv, da, no, fi, de, fr, es, nl, ar, he, ja, ko, zh) + 90+ total |
| **Deployment** | Cloud API (Anthropic infrastructure via GitHub) |
| **Usage Classification** | ⚠️ **Limited Risk** per EU AI Act Article 6 |

#### Intended Use Cases

✅ **Approved Uses** (Riksdagsmonitor context):
- Swedish political news article generation (14 languages)
- Parliamentary data summarization (Riksdag documents, votes, committees)
- Government document analysis (propositions, SOU reports, ministerial statements)
- Multi-language translation validation
- Factual content creation with source citations

❌ **Prohibited Uses** (per Hack23 AI Policy):
- Real-time critical decision-making without human oversight
- Personal data processing beyond public officials
- Financial predictions or investment advice
- Medical, legal, or safety-critical applications
- Content generation without human review

#### Known Capabilities

**Strengths**:
1. **Multilingual Excellence**: Native-level Swedish, strong Nordic languages (DA, NO, FI)
2. **Structured Output**: JSON, HTML, Markdown generation with consistent formatting
3. **Context Understanding**: 200K token window enables full Riksdag document analysis
4. **Factual Grounding**: Strong performance with factual queries when given proper context
5. **Citation Capability**: Able to include document IDs and source references

**Weaknesses**:
1. **Hallucination Risk**: 35% estimated hallucination rate on low-confidence queries
2. **Date Sensitivity**: Training cutoff (April 2026) limits real-time Swedish political events
3. **Non-Determinism**: Same prompt may yield different outputs across invocations
4. **Prompt Injection**: Vulnerable to indirect prompt injection via document titles
5. **Bias Potential**: Training data bias toward Western media sources and English-language content

#### Security Characteristics

**Authentication & Access Control**:
- ✅ GitHub Copilot authentication (Hack23 organization access)
- ✅ No direct Anthropic API keys stored
- ✅ GitHub Actions OIDC for secure workflow execution
- ⚠️ No per-workflow API key isolation

**Data Privacy**:
- ✅ Public data only (Swedish Riksdag/Government open data)
- ✅ No personal data beyond public officials
- ✅ No data retention by Anthropic (per GitHub Copilot terms)
- ✅ GDPR-compliant processing (public interest grounds)

**Model Integrity**:
- ✅ Anthropic-managed model (no local fine-tuning risk)
- ✅ Version-controlled API endpoint
- ⚠️ No model signature verification
- ⚠️ No API response integrity validation

**Rate Limiting & Availability**:
- ⚠️ GitHub Copilot API rate limits (organization-wide)
- ⚠️ No dedicated SLA for Riksdagsmonitor
- ✅ Graceful failure mode (skip generation on API unavailable)
- ✅ Human fallback (manual article creation)

#### Risk Assessment

**High-Risk Scenarios** (Requires Enhanced Controls):
1. **Fabricated Document IDs**: Model invents non-existent Riksdag documents
   - **Mitigation**: Mandatory dok_id validation against data.riksdagen.se API
   - **Status**: ⚠️ Planned Q1 2026

2. **Political Bias Amplification**: Training data bias influences party representation
   - **Mitigation**: Party mention tracking dashboard, bias metrics
   - **Status**: ⚠️ Planned Q2 2026

3. **Cross-Language Inconsistency**: Different factual claims across 14 languages
   - **Mitigation**: Cross-language consistency validation, translation markers
   - **Status**: ✅ Implemented (TRANSLATION_GUIDE.md)

**Medium-Risk Scenarios** (Monitoring Required):
1. **Vote Margin Errors**: Incorrect vote count arithmetic
   - **Mitigation**: Display full vote counts (not just margins), reviewer checklist
   - **Status**: ✅ Implemented

2. **Government Document Misattribution**: Wrong departmental attribution
   - **Mitigation**: analyze_g0v_by_department validation
   - **Status**: ✅ Implemented

**Low-Risk Scenarios** (Acceptable):
1. **Stylistic Variations**: Different writing styles across languages
   - **Mitigation**: Editorial guidelines, human review
   - **Status**: ✅ Implemented

2. **Translation Nuances**: Minor semantic differences in translations
   - **Mitigation**: Terminology dictionary (TRANSLATION_GUIDE.md)
   - **Status**: ✅ Implemented

#### Performance Benchmarks

**Accuracy Metrics** (Estimated - requires formal evaluation):
- **Factual Accuracy**: 65-75% without human review (hallucination risk)
- **Citation Accuracy**: 85-90% when document IDs provided via MCP
- **Translation Quality**: 90-95% for Swedish-English (professional level)
- **Multi-Language Consistency**: 80-85% (cross-language fact alignment)

**Human Review Impact**:
- **Post-Review Accuracy**: 98-99% (hallucination detection + correction)
- **False Positive Rate**: <5% (legitimate content rejected)
- **False Negative Rate**: Target <2% (fabrications published)

#### Maintenance & Monitoring

**Model Version Management**:
- ✅ Claude Opus 4.7 explicitly specified in workflow YAML
- ✅ GitHub Copilot API versioning (GitHub-managed)
- ⚠️ No automated model update testing
- ⚠️ No model deprecation alerting

**Performance Monitoring**:
- ✅ GitHub Actions workflow execution logs
- ✅ PR review rejection rate tracking
- ⚠️ No hallucination detection metrics (planned Q1 2026)
- ⚠️ No bias monitoring dashboard (planned Q2 2026)

**Incident Response**:
- ✅ Hallucination correction protocol (Section 9.3)
- ✅ MCP server compromise procedure (Section 9.3)
- ⚠️ No AI-specific incident classification system
- ⚠️ No AI incident postmortem template

#### Compliance & Governance

**EU AI Act Classification**: ⚠️ **Limited Risk** (Article 52)
- Transparency obligations met (AI-generated content disclosure)
- Human oversight required (mandatory PR review)
- No high-risk use cases

**ISO/IEC 42001:2023**: ✅ **Compliant**
- AI Policy § 5.2 (documented AI governance)
- Risk assessment § 6.1 (18 AI threats identified)
- Competence § 8.2 (human reviewer training required)

**OWASP LLM Top 10**: ⚠️ **Partial** (50% controls implemented)
- LLM09 (Overreliance) highest priority gap
- Q1-Q2 2026 remediation roadmap

**Supplier Assessment**: ✅ **Approved**
- Anthropic AI supplier assessment completed
- GitHub Copilot contract review (data residency, privacy)
- No high-risk vendor findings

#### Updates & Deprecation

**Model Lifecycle**:
- **Current Version**: Claude Opus 4.7 (deployed 2026-04)
- **Expected Lifespan**: 12-18 months (until Claude Opus 5.x release)
- **Deprecation Policy**: 90-day notice before model version changes
- **Migration Plan**: Test new model versions on staging branch before production

**Security Patch Management**:
- Anthropic-managed security patches (vendor responsibility)
- GitHub Copilot API updates (GitHub-managed)
- Workflow YAML security updates (Hack23 responsibility)
- MCP server updates (Hack23 responsibility)

---

---

## 🌐 Frontend-Specific Security Architecture

As a **static HTML/CSS/JavaScript website** with no backend services, Riksdagsmonitor has unique security characteristics distinct from traditional multi-tier web applications.

### **Static Website Security Model**

```mermaid
graph TB
    subgraph "Traditional Web App [NOT APPLICABLE]"
        Backend[Backend Services<br/>❌ None]
        Database[Database<br/>❌ None]
        Auth[User Authentication<br/>❌ None]
        API[Private APIs<br/>❌ None]
    end
    
    subgraph "Riksdagsmonitor Architecture [ACTUAL]"
        Frontend[Static Frontend<br/>✅ HTML/CSS/JS Only]
        CDN[Content Delivery<br/>✅ CloudFront + GitHub Pages]
        PublicData[Public Data Sources<br/>✅ riksdag-regering-mcp]
        AIGen[AI Content Generation<br/>✅ GitHub Actions + Claude]
    end
    
    Frontend --> CDN
    CDN --> PublicData
    AIGen --> Frontend
    
    style Backend fill:#f44336,color:#fff,stroke-dasharray: 5 5
    style Database fill:#f44336,color:#fff,stroke-dasharray: 5 5
    style Auth fill:#f44336,color:#fff,stroke-dasharray: 5 5
    style API fill:#f44336,color:#fff,stroke-dasharray: 5 5
    style Frontend fill:#4caf50,color:#000
    style CDN fill:#4caf50,color:#000
    style PublicData fill:#4caf50,color:#000
    style AIGen fill:#4caf50,color:#000
```

### **Threats Eliminated by Static Architecture**

| Traditional Web Threat | Riksdagsmonitor Status | Rationale |
|------------------------|----------------------|-----------|
| **SQL Injection** | ❌ NOT APPLICABLE | No database, no SQL queries |
| **Server-Side Code Execution** | ❌ NOT APPLICABLE | No server-side code (PHP/Python/Java) |
| **Session Hijacking** | ❌ NOT APPLICABLE | No user sessions, no authentication |
| **Insecure Deserialization** | ❌ NOT APPLICABLE | No serialization (no user input processing) |
| **Server Misconfiguration** | ❌ NOT APPLICABLE | No web server (AWS CloudFront + S3 managed services) |
| **Broken Authentication** | ❌ NOT APPLICABLE | No user accounts |
| **Sensitive Data Exposure** | ❌ NOT APPLICABLE | All data is public by design |
| **CSRF (Cross-Site Request Forgery)** | ❌ NOT APPLICABLE | No state-changing operations |
| **Security Logging Failures** | ⚠️ REDUCED RISK | Limited logging scope (no user actions) |

**Security Benefit:** Static architecture eliminates **9 of OWASP Top 10** traditional web app vulnerabilities. Only client-side threats remain (XSS, supply chain, CDN compromise).

### **Frontend-Specific Threat Landscape**

#### Unique Threat Categories for Static Websites:

| Threat Category | Description | Riksdagsmonitor Specific | Priority |
|-----------------|-------------|-------------------------|----------|
| **CDN Compromise** | Malicious content served via CloudFront/GitHub Pages | Chart.js/D3.js via jsDelivr | **HIGH** |
| **XSS (Client-Side)** | JavaScript injection in dashboards | Dashboard code only attack surface | **MEDIUM** |
| **Supply Chain (npm)** | Compromised JavaScript dependencies | Vite, Chart.js, D3.js | **HIGH** |
| **Domain Hijacking** | DNS takeover, typosquatting | riksdagsmonitor.com protection | **MEDIUM** |
| **Content Integrity** | Repository tampering, malicious PRs | Git immutability, GPG signing | **HIGH** |
| **Availability (DDoS)** | Volumetric attacks on CDN | AWS Shield, multi-region | **MEDIUM** |
| **SEO Poisoning** | Manipulation of search engine rankings | Static HTML metadata control | **LOW** |
| **Caching Poisoning** | Malicious content cached in CDN | S3 versioning, CloudFront invalidation | **LOW** |

#### Frontend Security Controls:

| Control | Purpose | Implementation | Effectiveness |
|---------|---------|----------------|--------------|
| **Content Security Policy (CSP)** | Prevent XSS, restrict script sources | `script-src 'self' cdn.jsdelivr.net; object-src 'none'` | 95% |
| **Subresource Integrity (SRI)** | Verify CDN asset integrity | SHA-384 hashes for Chart.js/D3.js | 99.9% |
| **HTTPS Everywhere** | Encrypt all traffic | TLS 1.3, HSTS preload, no HTTP fallback | 99% |
| **Static Content Immutability** | Prevent runtime manipulation | S3 versioning, Git history | 98% |
| **No User Input Processing** | Eliminate injection vectors | Read-only platform, no forms | 100% |
| **Browser Security Features** | Leverage native browser protections | X-Frame-Options, X-Content-Type-Options | 90% |

### **Dashboard Security Analysis (Chart.js/D3.js)**

#### Threat Surface: Interactive JavaScript Dashboards

**4 Functional Dashboards:**
1. **Overview Dashboard** - General political metrics (Chart.js)
2. **Party Performance Dashboard** - Coalition analysis (D3.js)
3. **Ministry Activity Dashboard** - Government activity tracking (Chart.js)
4. **Legislative Timeline** - Bill progression visualization (D3.js)

**5 Placeholder Dashboards:** Design-only (no JavaScript execution risk)

#### Dashboard-Specific Threats:

| Threat | Attack Vector | Likelihood | Impact | Mitigation | Residual Risk |
|--------|--------------|-----------|--------|-----------|--------------|
| **XSS via CIA Data** | Malicious data in CSV causes DOM-based XSS | LOW (2) | HIGH (8) | CSP, HTML entity escaping in Chart.js configs | **LOW (1.6)** |
| **Prototype Pollution** | Malicious object injection in Chart.js options | VERY LOW (1) | MEDIUM (5) | Object.freeze() on configs, Chart.js latest version | **VERY LOW (0.5)** |
| **DoS via Rendering** | Malformed data crashes Chart.js | LOW (2) | LOW (3) | Try-catch error handling, dashboard timeouts | **VERY LOW (0.6)** |
| **CDN Supply Chain** | Compromised Chart.js/D3.js from jsDelivr | LOW (2) | HIGH (8) | SRI hashes (SHA-384), trusted CDN | **LOW (1.6)** |
| **Memory Leak** | Inefficient D3.js rendering exhausts browser memory | VERY LOW (1) | MEDIUM (5) | D3.js best practices, cleanup on unmount | **VERY LOW (0.5)** |

**Dashboard Security Posture:** **LOW RISK** (average risk score: 1.2/10)

---

## 📊 Democratic Threat Catalog Framework

Following [Hack23 Threat Modeling Policy § 4.4](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#scenario-centric-analysis), we develop domain-specific threat scenarios for Swedish democratic transparency platforms.

### **Democratic Transparency Threat Taxonomy**

| Threat Category | Description | Riksdagsmonitor Impact | Mitigation Strategy |
|-----------------|-------------|----------------------|---------------------|
| **🗳️ Electoral Integrity** | Manipulation of voting data, false election results | HIGH - Core mission threat | Document ID validation, cross-verification |
| **📊 Legislative Misinformation** | Fabricated committee reports, fake parliamentary documents | HIGH - Undermines transparency | riksdag-regering-mcp verification, fact-checking |
| **🏛️ Institutional Distrust** | Erosion of trust in Riksdag, government agencies | CRITICAL - Mission failure | Transparency commitment, public corrections |
| **🗣️ Political Narrative Manipulation** | Biased AI-generated content favoring specific parties | MEDIUM - Reputational risk | Party mention tracking, bias metrics (planned Q2 2026) |
| **🌐 Cross-Border Disinformation** | Foreign influence operations via AI content generation | HIGH - Nation-state APT threat | AI output validation, human oversight |
| **📰 Media Manipulation** | False attribution to Riksdagsmonitor in media reports | MEDIUM - Brand impersonation | Clear branding, AI-generated disclosure |
| **🔍 Transparency Undermining** | DDoS during critical political events (elections, votes) | MEDIUM - Availability threat | Multi-region CDN, DR failover |
| **🤝 Civil Society Trust** | Loss of transparency advocate support | HIGH - Stakeholder alienation | Incident transparency, public accountability |

### **Swedish Political Context Threats**

#### Riksdag-Specific Threats:

| Threat | Swedish Political Context | Attack Scenario | Current Controls | Gap Analysis |
|--------|---------------------------|----------------|------------------|--------------|
| **Betänkande Manipulation** | "Betänkande" (committee report) mistranslation | AI translates "betänkande" as "consideration" instead of "committee report" across 14 languages | TRANSLATION_GUIDE.md terminology dictionary | ⚠️ GAP: No automated translation validation (planned Q2 2026) |
| **Riksdagsbeslut Fabrication** | "Riksdagsbeslut" (parliamentary decision) fake records | AI hallucinates non-existent parliamentary decisions with plausible dok_id | Document ID validation (manual PR review) | ⚠️ GAP: No automated API verification (planned Q1 2026) |
| **Utskott Misattribution** | Committee ("utskott") jurisdiction errors | AI attributes motion to wrong committee (e.g., Finance instead of Foreign Affairs) | riksdag-regering-mcp organ field validation | ✅ ADEQUATE: MCP returns correct organ code |
| **Voteringsresultat Arithmetic** | Vote margin calculation errors | AI reports 175-174 vote when actual is 176-173 | Display full vote counts (not margins), PR review | ⚠️ GAP: No automated vote arithmetic validation |
| **Partirepresentation Bias** | Unequal party coverage in AI news | AI-generated articles favor specific parties (e.g., more positive language for S vs. SD) | Editorial guidelines, human review | ⚠️ GAP: No party mention tracking dashboard (planned Q2 2026) |

#### Regeringen-Specific Threats:

| Threat | Swedish Government Context | Attack Scenario | Current Controls | Gap Analysis |
|--------|----------------------------|----------------|------------------|--------------|
| **Proposition Fabrication** | Fake government propositions (prop.) | AI invents non-existent proposition with fabricated prop number | regeringen.se URL validation via g0v.se | ✅ ADEQUATE: All propositions require valid URL |
| **SOU/Ds Report Misattribution** | Government inquiry (SOU/Ds) incorrect department | AI attributes SOU report to wrong ministry | analyze_g0v_by_department validation | ✅ ADEQUATE: MCP returns correct department |
| **Ministerial Quote Fabrication** | Fake statements from Swedish ministers | AI generates quotes attributed to ministers that were never said | Source citations (g0v.se URLs), PR review | ⚠️ GAP: No automated quote verification against speech transcripts |
| **Government Document Metadata** | Incorrect document dates, departments | AI reports wrong publication date or departmental origin | get_g0v_document_content metadata validation | ✅ ADEQUATE: MCP returns structured metadata |
| **Remiss Process Misrepresentation** | Incorrect remiss (public consultation) status | AI reports closed remiss as open or vice versa | g0v.se remiss status field | ✅ ADEQUATE: MCP returns current status |

### **Democratic Accountability Metrics**

| Metric | Target | Current Performance | Monitoring Method |
|--------|--------|---------------------|------------------|
| **Factual Accuracy (Post-Review)** | 98%+ | 98-99% (estimated) | PR rejection rate tracking |
| **Hallucination Detection Rate** | 95%+ | 95% (human review) | Fact-checking protocol compliance |
| **Cross-Language Consistency** | 90%+ | 80-85% (estimated) | Manual spot-checks (planned automation Q2 2026) |
| **Party Representation Balance** | ±5% variance | Not measured | ⚠️ GAP: Planned Q2 2026 dashboard |
| **Document ID Validation Coverage** | 100% | 100% (manual) | PR review checklist |
| **Translation Quality (Human Review)** | 90%+ | 90-95% (estimated) | TRANSLATION_GUIDE.md compliance |

### **Civic Technology Threat Scenarios**

#### Scenario: Election Day Disinformation Campaign

**Threat Actor:** Nation-State APT (Foreign Intelligence Service)  
**Timing:** Swedish parliamentary election Sunday (September 2026)  
**Attack Vector:**
1. **Pre-positioning (Weeks Before):** Compromise MCP server, inject subtle bias in AI content generation
2. **Activation (Election Day):** Publish false exit poll data, fabricate early vote counts
3. **Amplification (Social Media):** Coordinate with bot networks to spread misinformation
4. **Persistence (Post-Election):** Maintain doubt about election integrity

**Impact:**
- Erosion of public trust in Swedish election results
- International media attention questioning Swedish democracy
- Long-term reputational damage to Riksdagsmonitor
- Potential legal liability for spreading false information

**Mitigation:**
- **Pre-Election:** Freeze AI content generation 48h before election (manual mode only)
- **During Election:** Heightened human review, no automated political data publication
- **Post-Election:** Cross-verify all results with official Riksdag sources before publication
- **Incident Response:** Pre-drafted public statement, CEO accountability, transparent correction process

**Residual Risk:** **MEDIUM** (2.5/10) - Accept risk with enhanced monitoring during high-stakes events

---

## 🔄 Continuous Validation & Assessment

Following [Hack23 Threat Modeling Policy § 5](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#continuous-assessment) and [§ 6.7](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#continuous-improvement), we establish continuous threat model maintenance procedures.

### **🎪 Threat Modeling Workshop Process**

Following [Hack23 AB Workshop Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#threat-modeling-workshop) with riksdagsmonitor-specific adaptations:

#### **📋 Workshop Lifecycle (PRE → MONITOR)**

| Phase | Activity | Riksdagsmonitor Implementation | Output | Responsible |
|-------|----------|-------------------------------|--------|-------------|
| **PRE** | Scope definition, asset inventory refresh, participant assembly | Review 14-language site, AI workflows, AWS infrastructure, dashboard features | Updated scope, participant roster | CEO + Security Architect |
| **ENUM** | Enumerate all system components, data flows, trust boundaries | Update C4 diagrams (Level 1+2), DFD with STRIDE annotations, identify new AI workflow changes | Component inventory, updated DFD | Security Architect |
| **THREATS** | Systematic threat identification using STRIDE per element | Apply STRIDE to each DFD element; integrate MITRE ATT&CK techniques; review OWASP LLM Top 10 | Threat register (currently 70 threats) | Security Architect + Dev Team |
| **MAP** | Map threats to controls, identify gaps, assess residual risk | Map each threat to PREV/DET/CORR controls; calculate risk scores; identify ATT-GAP items | Control mapping, gap analysis | Security Architect |
| **PLAN** | Prioritize remediation, assign owners, set timelines | Create remediation backlog; assign to quarterly milestones; budget control improvements | Remediation plan with deadlines | CEO |
| **VALIDATE** | Verify controls are effective, test detection mechanisms | Run CodeQL, Dependabot scan, SRI validation, CSP audit; test DR failover | Validation evidence, test results | Quality Engineer |
| **MONITOR** | Continuous monitoring, metrics tracking, threat intelligence updates | Track 10 security metrics (see below); integrate ENISA/CERT-SE/MITRE updates | Dashboard metrics, quarterly report | CEO + Security Architect |

#### **👥 Workshop Team Assembly**

- **🛡️ Security Architect:** Threat analysis, control design, STRIDE/MITRE integration
- **👨‍💼 CEO/CISO:** Risk acceptance, business impact assessment, final approval
- **💻 Development Team:** Implementation feasibility, code-level threat review
- **🤖 AI Workflow Expert:** OWASP LLM Top 10, prompt injection risks, AI hallucination analysis
- **📊 Quality Engineer:** Validation testing, accessibility compliance, CI/CD security

#### **📅 Assessment Lifecycle Schedule**

| Assessment Type | Trigger | Frequency | Scope | Output |
|----------------|---------|-----------|-------|--------|
| **Full Workshop (PRE → MONITOR)** | Quarterly review, major architecture change | Quarterly (Feb, May, Aug, Nov) | All 7 phases, complete threat model review | Updated THREAT_MODEL.md |
| **Targeted Assessment** | New AI workflow, dashboard feature, dependency update | As needed (within 2 weeks of change) | ENUM → MAP phases for affected components | Targeted threat update |
| **Incident-Driven Review** | Security incident, near-miss, control failure | Within 1 week of incident | THREATS → PLAN phases for incident scope | Incident lessons learned, control improvements |
| **Threat Intelligence Update** | ENISA report, MITRE ATT&CK update, CERT-SE advisory | As published | MAP → MONITOR phases | Updated threat agent analysis |
| **Election Period Heightened Review** | 60 days before Swedish/EU elections | Pre-election cycle | Full review with election-specific scenarios | Election security posture report |

### **Threat Model Update Triggers**

| Trigger Category | Trigger Event | Update Scope | Timeline | Responsible |
|-----------------|---------------|--------------|----------|-------------|
| **Architecture Changes** | New AI workflow, dashboard feature, CDN migration | Full STRIDE re-analysis | Within 2 weeks | Security Architect |
| **Incident-Driven** | Security incident, near-miss, control failure | Incident-specific sections | Within 1 week | CEO + Security Architect |
| **Regulatory Changes** | EU AI Act updates, GDPR amendments, NIS2 | Compliance mapping sections | Within 1 month | Compliance Officer (CEO) |
| **Threat Landscape** | ENISA report updates, new MITRE ATT&CK techniques | Threat agent analysis, MITRE section | Quarterly | Security Architect |
| **Technology Changes** | New dependencies (npm packages), CDN provider change | Supply chain threats, control framework | Within 2 weeks | Security Architect |
| **Scheduled Review** | Quarterly threat model review | All sections (comprehensive) | Quarterly (Feb, May, Aug, Nov) | CEO |

### **Continuous Monitoring Metrics**

| Security Metric | Target | Current | Monitoring Frequency | Alert Threshold |
|-----------------|--------|---------|---------------------|-----------------|
| **GitHub Secret Scanning Alerts** | 0 active | 0 | Real-time | 1+ alert |
| **Dependabot Vulnerabilities** | <3 Medium+ | 0 | Daily | 5+ Medium or 1+ High |
| **CodeQL Findings** | 0 High+ | 0 | Per PR | 1+ High |
| **CSP Violation Reports** | <10/day | 2-5/day | Daily | 50+/day |
| **SRI Validation Failures** | 0 | 0 | Real-time | 1+ failure |
| **PR Review Rejection Rate (AI)** | <10% | ~5% | Weekly | 20%+ (indicates hallucination spike) |
| **AWS CloudTrail Anomalies** | 0 | 0 | Daily | 1+ anomaly |
| **S3 Unauthorized Access Attempts** | 0 | 0 | Real-time | 1+ attempt |
| **DDoS Attack Volume** | <1/quarter | 0 YTD | Weekly | Active attack |
| **AI Hallucination Detection (Manual)** | <5% | ~2-3% | Per PR | 10%+ |

### **Threat Intelligence Sources**

| Source | Type | Update Frequency | Integration Method | Cost |
|--------|------|------------------|-------------------|------|
| **ENISA Threat Landscape** | Industry report | Annual | Manual review, threat agent updates | Free |
| **MITRE ATT&CK Framework** | Technique database | Quarterly | Technique mapping review | Free |
| **OWASP LLM Top 10** | LLM security guidance | Annual | AI threat section updates | Free |
| **GitHub Security Advisories** | Dependency vulnerabilities | Real-time | Dependabot integration | Free (GitHub plan) |
| **AWS Security Bulletins** | Infrastructure advisories | Weekly | Manual monitoring | Free |
| **CVE Database (NVD)** | Vulnerability disclosures | Daily | Dependabot + manual review | Free |
| **Swedish CERT-SE** | National threat intelligence | Ad-hoc | Email alerts | Free |

**Next Review:** 2026-05-15 (Quarterly schedule)

---

## 🌐 Current Threat Landscape Integration

Per [ENISA Threat Landscape 2024](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024) and [Hack23 Threat Modeling Policy § 3.1](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#current-threat-landscape), we integrate current cyber threat trends into Riksdagsmonitor analysis.

### **🇪🇺 ENISA Threat Landscape 2024 — Priority Threat Category Mapping**

Mapping Riksdagsmonitor exposure to all 7 ENISA priority threat categories:

| # | ENISA Priority Threat Category | Riksdagsmonitor Exposure | Applicable Attack Vectors | Current Controls | Residual Risk | MITRE ATT&CK Alignment |
|---|-------------------------------|-------------------------|--------------------------|-----------------|--------------|------------------------|
| 1 | **🔒 Threats Against Availability** | **HIGH** — CloudFront/GitHub Pages are public-facing; DDoS during Swedish elections is credible | L7 flood, DNS amplification, CDN exhaustion | AWS Shield Standard (PREV-021), multi-region DR (PREV-020), Route 53 failover (PREV-022) | **LOW** | [T1498](https://attack.mitre.org/techniques/T1498/), [T1499](https://attack.mitre.org/techniques/T1499/) |
| 2 | **💰 Ransomware** | **LOW** — No server-side infrastructure to encrypt; static assets recoverable from Git | Supply chain ransomware (npm ecosystem), GitHub account compromise | Dependabot (PREV-013), MFA (PREV-001), S3 versioning (PREV-019), Git immutable history | **VERY LOW** | [T1486](https://attack.mitre.org/techniques/T1486/) |
| 3 | **📊 Threats Against Data** | **MEDIUM** — Public political data integrity is critical; no private user data | Data manipulation via AI hallucination, CDN content poisoning, commit tampering | SRI (PREV-012), mandatory PR review (PREV-028), branch protection (PREV-002), GPG signing (PREV-003) | **LOW** | [T1565](https://attack.mitre.org/techniques/T1565/), [T1659](https://attack.mitre.org/techniques/T1659/) |
| 4 | **🦠 Malware** | **LOW** — Static website cannot execute server-side malware; client-side risk via CDN | Malicious npm package, compromised Chart.js/D3.js CDN asset | CSP (PREV-011), SRI (PREV-012), Dependabot (PREV-013), CodeQL (PREV-014) | **VERY LOW** | [T1195.002](https://attack.mitre.org/techniques/T1195/002/) |
| 5 | **🎣 Social Engineering** | **MEDIUM** — GitHub contributor phishing, credential theft for deployment access | Phishing for GitHub PAT/MFA bypass, impersonation of maintainers | MFA (PREV-001), OIDC (PREV-006), secret scanning (PREV-005), security awareness | **LOW** | [T1566](https://attack.mitre.org/techniques/T1566/), [T1078](https://attack.mitre.org/techniques/T1078/) |
| 6 | **📰 Information Manipulation** | **CRITICAL** — AI-generated political news is the #1 threat vector for democratic manipulation | AI hallucination injection, prompt injection, data source poisoning, translation manipulation | Mandatory PR review (PREV-028), MCP freshness validation (PREV-026), document ID validation (PREV-024) | **MEDIUM** | [T1659](https://attack.mitre.org/techniques/T1659/) |
| 7 | **🔗 Supply Chain Attacks** | **HIGH** — npm ecosystem, Chart.js/D3.js CDN, GitHub Actions marketplace | Compromised npm packages, CDN poisoning, malicious GitHub Actions | SRI (PREV-012), SHA-pinned Actions (PREV-015), Dependabot (PREV-013), SBOM generation | **LOW** | [T1195](https://attack.mitre.org/techniques/T1195/) |

**ENISA Integration Summary:**
- **CRITICAL exposure:** Information Manipulation (ENISA #6) — directly targets riksdagsmonitor's AI-generated democratic content
- **HIGH exposure:** Availability threats and Supply Chain attacks — addressed by multi-layer controls
- **Risk-accepted:** Ransomware and Malware are structurally mitigated by static-site architecture
- **Overall ENISA alignment:** 7/7 categories assessed, controls mapped, residual risk documented

### **2024-2026 Threat Trends Applicable to Riksdagsmonitor**

| ENISA Threat Trend | Riksdagsmonitor Relevance | Implementation Status | Residual Risk |
|-------------------|--------------------------|----------------------|--------------|
| **Supply Chain Attacks (Ransomware)** | HIGH - npm dependencies, Chart.js/D3.js CDN | ✅ Dependabot, SRI hashes, SHA-pinned GitHub Actions | **LOW** |
| **DDoS Attacks (IoT Botnets)** | MEDIUM - CloudFront + GitHub Pages targets | ✅ AWS Shield Standard, multi-region architecture | **LOW** |
| **Disinformation Campaigns (AI-Generated)** | **CRITICAL** - AI news generation workflows | ⚠️ Partial - PR review, planned automated validation Q1 2026 | **MEDIUM** |
| **Social Engineering (Phishing)** | MEDIUM - GitHub contributor accounts | ✅ MFA enforcement, security awareness training | **LOW** |
| **API Vulnerabilities** | LOW - No private APIs (public MCP server only) | ✅ HTTPS-only, freshness validation | **LOW** |
| **Data Breaches (Cloud Misconfigurations)** | MEDIUM - AWS S3 bucket exposure risk | ✅ IAM least privilege, bucket policy, OIDC | **LOW** |
| **Cryptojacking (XSS)** | LOW - Static website, no server-side execution | ✅ CSP, SRI, no user input processing | **VERY LOW** |
| **Zero-Day Exploits (CDN/Browser)** | LOW - Vendor responsibility (AWS, GitHub, browsers) | ✅ Vendor patching, security monitoring | **LOW** |

### **Geopolitical Threat Context: Swedish Democratic Transparency**

**Heightened Risk Periods:**
- **Swedish Parliamentary Elections:** September 2026 (next scheduled) - **HIGH RISK**
- **EU Parliamentary Elections:** June 2024 (past), June 2029 (future) - **MEDIUM RISK**
- **Swedish Government Formation Periods:** Post-election coalition negotiations - **HIGH RISK**
- **Major Parliamentary Votes:** Defense spending, NATO accession, EU policy - **MEDIUM RISK**

**Nation-State Threat Actors with Swedish Interest:**
- **Russia:** Historical information warfare campaigns targeting Swedish politics
- **China:** Economic espionage, influence operations
- **Iran:** Cyber operations against Swedish infrastructure

**Mitigation for High-Risk Periods:**
- Freeze AI content generation 48-72 hours before/during critical events (manual mode only)
- Enhanced human review with security team approval
- Pre-drafted incident response statements
- Heightened AWS CloudTrail and GitHub audit log monitoring

---

## 🎯 Multi-Strategy Threat Modeling Implementation

Demonstrating [Hack23 Threat Modeling Policy § 4](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md) five-strategy integrated approach:

### **🧠 Multi-Strategy Integration Mindmap**

```mermaid
mindmap
  root((🎯 Riksdagsmonitor<br/>Threat Modeling Strategies))
    (🎖️ Attacker-Centric)
      [MITRE ATT&CK 23 techniques]
      [9 ATT&CK tactics covered]
      [Kill Chain disruption 76%]
      [Threat agent profiles × 7]
      [ENISA TL 2024 alignment]
    (🏗️ Asset-Centric)
      [10 assets classified]
      [5 Crown Jewels ranked]
      [$180K annual value]
      [CIA triad per asset]
      [Attack attractiveness scored]
    (🏛️ Architecture-Centric)
      [STRIDE per DFD element]
      [C4 Level 1+2 diagrams]
      [Trust boundary analysis]
      [26 STRIDE threats mapped]
      [6-category control mapping]
    (🎯 Scenario-Centric)
      [6 priority scenarios]
      [9 attack trees]
      [AI hallucination misuse case]
      [Election interference what-if]
      [Supply chain CDN scenario]
    (⚖️ Risk-Centric)
      [Quantitative risk scoring]
      [Likelihood × Impact matrix]
      [Risk treatment 100% coverage]
      [ROI 682% on controls]
      [Business impact $180K]
```

### **Strategy Integration Matrix**

| Strategy | Section(s) | Implementation Status | Key Outputs |
|----------|-----------|----------------------|-------------|
| **1️⃣ Attacker-Centric (MITRE ATT&CK)** | § MITRE ATT&CK Framework Integration | ✅ Complete | 23 techniques mapped, 9 tactics covered |
| **2️⃣ Asset-Centric (Crown Jewels)** | § Critical Assets & Protection Goals | ✅ Complete | 10 assets classified, 5 Crown Jewels, $180K annual value |
| **3️⃣ Architecture-Centric (STRIDE per Element)** | § Data Flow & Architecture Analysis | ✅ Complete | 26 STRIDE threats across DFD elements (subset of 52 total STRIDE threats across all strategies) |
| **4️⃣ Scenario-Centric (Misuse Cases)** | § Priority Threat Scenarios + § Attack Tree Analysis | ✅ Complete | 9 attack trees (3 dedicated + 6 embedded scenarios) |
| **5️⃣ Risk-Centric (Quantitative Assessment)** | § Enhanced Risk-Centric Analysis (next section) | ✅ Complete | Risk scores, cost avoidance quantified |

**Integration Score:** **100%** (All 5 strategies implemented per ISMS requirements)

### **PASTA Framework Integration**

PASTA (Process for Attack Simulation and Threat Analysis) provides a risk-centric, attacker-focused methodology complementing STRIDE for riksdagsmonitor's democratic mission.

| PASTA Stage | Description | Riksdagsmonitor Implementation | Output |
|-------------|-------------|-------------------------------|--------|
| **Stage I: Define Objectives** | Business and security objectives | Democratic transparency, accurate Swedish political data, 14-language access | Mission statement, business objectives |
| **Stage II: Define Technical Scope** | Application + infrastructure inventory | Static website, AI workflows, AWS CloudFront, riksdag-regering-mcp, GitHub Actions | Asset inventory (ASSET-001 to ASSET-010) |
| **Stage III: Application Decomposition** | DFD, trust boundaries, data flows | C4 architecture diagrams, STRIDE per DFD element, trust boundary documentation | Architecture diagrams, DFDs |
| **Stage IV: Threat Analysis** | Threat intelligence integration | ENISA 2024/2025 trends, MITRE ATT&CK 23 techniques, Swedish CERT-SE advisories | Threat agent profiles, MITRE mapping |
| **Stage V: Vulnerability Analysis** | Identify weaknesses per component | CodeQL static analysis, Dependabot, GitHub Secret Scanning, SRI validation | Vulnerability tracking (ATT-GAP-001/002/003) |
| **Stage VI: Attack Modeling** | Realistic attack scenarios | 9 attack trees: defacement, misinformation, CDN supply chain, AI hallucination | Attack trees with probability estimates |
| **Stage VII: Risk/Impact Analysis** | Quantify business impact | $180K cost avoidance, risk scores (0-10), ROI 682% | Risk matrix, treatment decisions |

**PASTA Applicability for Riksdagsmonitor:**
- ✅ Risk-first approach aligns with democratic mission (election integrity > financial impact)
- ✅ Business objective mapping: Transparency ↔ Integrity, Availability ↔ Access to democracy
- ✅ Attacker simulation: AI misinformation actors, nation-state APTs, hacktivists modeled
- ✅ Seven-stage completion demonstrates mature threat modeling practice

### **Trike Risk-Centric Approach**

Trike focuses on acceptable risk and security auditing, ensuring every threat has an explicit risk treatment decision — fully aligned with Hack23 ISMS policy.

| Trike Concept | Riksdagsmonitor Application | Implementation |
|---------------|----------------------------|----------------|
| **Actor → Asset → Action** model | Threat agent → Crown Jewel → Attack type mapping | 7 threat agent profiles × 5 Crown Jewels × STRIDE actions |
| **Acceptable Risk Definition** | CEO-defined risk tolerance thresholds | Risk Score ≤ 3.2/10 acceptable; 0 CRITICAL risks tolerated |
| **Threat Enumeration Completeness** | All actor-asset-action triples evaluated | 52 STRIDE threats + 18 AI/LLM threats = 70 total threat entries |
| **Permission Model** | Intended vs. implemented access rights | GitHub OIDC scopes, AWS IAM policies, MCP server access controls |
| **Risk Treatment Tracking** | Every threat has explicit treatment | 0 AVOID, 48 MITIGATE, 4 TRANSFER, 18 ACCEPT (70 threats, 100% coverage) |
| **Audit Trail** | All changes tracked to threat model | Git commit history, quarterly review schedule |

**Trike Benefits for Riksdagsmonitor:**
- ✅ Auditability: Every threat has explicit MITIGATE/TRANSFER/ACCEPT decision
- ✅ Completeness check: Actor-asset-action matrix prevents threat omissions
- ✅ Democratic accountability: CEO-level risk acceptance for all residual risks
- ✅ Continuous improvement: Risk threshold adjustments tracked over time

### **Combined Framework Benefits**

```mermaid
graph LR
    STRIDE["🎭 STRIDE<br/>Architecture-centric<br/>Threat categories<br/>per DFD element"]
    ATT["🎖️ MITRE ATT&CK<br/>Attacker-centric<br/>Tactics & techniques<br/>Real-world TTPs"]
    PASTA["🔬 PASTA<br/>Risk-centric<br/>Business objectives<br/>Attack simulation"]
    TRIKE["⚖️ Trike<br/>Audit-centric<br/>Acceptable risk<br/>Treatment tracking"]
    OWASP["🤖 OWASP LLM<br/>AI-specific<br/>LLM Top 10<br/>AI workflow security"]

    STRIDE -->|"Threat categories"| Combined["🏆 Integrated<br/>Riksdagsmonitor<br/>Threat Model<br/>70 threats<br/>$180K value<br/>Level 4.25/5"]
    ATT -->|"Real-world TTPs"| Combined
    PASTA -->|"Business risk"| Combined
    TRIKE -->|"Risk decisions"| Combined
    OWASP -->|"AI threats"| Combined

    style Combined fill:#2196f3,color:#fff
    style STRIDE fill:#4caf50,color:#000
    style ATT fill:#ff9800,color:#000
    style PASTA fill:#9c27b0,color:#fff
    style TRIKE fill:#f44336,color:#fff
    style OWASP fill:#607d8b,color:#fff
```

---

## ⚖️ Enhanced Risk-Centric Analysis

Following [Hack23 Threat Modeling Policy § 4.5](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#risk-centric-quantitative-assessment), we provide quantitative risk analysis with business impact.

### **Risk Scoring Methodology**

**Likelihood Scale (1-5):**
- **5 (CRITICAL):** >80% probability within 12 months
- **4 (HIGH):** 60-80% probability
- **3 (MEDIUM):** 30-60% probability
- **2 (LOW):** 10-30% probability
- **1 (VERY LOW):** <10% probability

**Impact Scale (1-10):**
- **10 (CATASTROPHIC):** >$100K loss, mission failure, severe reputation damage
- **8 (HIGH):** $50K-$100K loss, major reputation damage
- **5 (MEDIUM):** $10K-$50K loss, moderate reputation impact
- **3 (LOW):** $1K-$10K loss, minor reputation impact
- **1 (MINIMAL):** <$1K loss, negligible impact

**Risk Score:** `Likelihood (1-5) × Impact (1-10) = Risk Score (1-50 scale → normalized to 0-10)`

### **Quantitative Risk Matrix**

```mermaid
graph TD
    subgraph "Risk Matrix (Likelihood × Impact)"
        Critical["🔴 CRITICAL RISK<br/>Score: 8.0-10.0<br/>Count: 0 threats"]
        High["🟠 HIGH RISK<br/>Score: 4.0-7.9<br/>Count: 2 threats"]
        Medium["🟡 MEDIUM RISK<br/>Score: 2.0-3.9<br/>Count: 8 threats"]
        Low["🟢 LOW RISK<br/>Score: <2.0<br/>Count: 42 threats"]
    end
    
    Critical --> Action1["IMMEDIATE ACTION<br/>CEO approval required<br/>< 1 week remediation"]
    High --> Action2["HIGH PRIORITY<br/>Q1 2026 remediation<br/>Enhanced monitoring"]
    Medium --> Action3["MONITORED<br/>Existing controls adequate<br/>Planned improvements"]
    Low --> Action4["ACCEPTED<br/>Risk tolerance met<br/>Routine monitoring"]
    
    style Critical fill:#f44336,color:#fff
    style High fill:#ff9800,color:#000
    style Medium fill:#ffc107,color:#000
    style Low fill:#4caf50,color:#000
```

### **Top 10 Highest Risk Threats**

| Rank | Threat ID | Threat Name | STRIDE | Likelihood | Impact | Risk Score | Status | Remediation Plan |
|------|----------|------------|--------|-----------|--------|-----------|--------|-----------------|
| **1** | AI-H1 (LLM09) | AI hallucination misinformation published | Information Disclosure | MEDIUM (3) | CRITICAL (10) | **3.0** | ⚠️ **MEDIUM** | Q1 2026: Automated dok_id API verification |
| **2** | AI-P1 (LLM01) | Prompt injection via riksdag documents | Tampering | MEDIUM (3) | HIGH (8) | **2.8** | ⚠️ **MEDIUM** | Q1 2026: Enhanced input sanitization |
| **3** | AI-T1 | Cross-language translation inconsistency | Tampering | MEDIUM (3) | HIGH (8) | **2.4** | ⚠️ **MEDIUM** | Q2 2026: Consistency validation tool |
| **4** | T1 | Repository content tampering | Tampering | LOW (2) | CRITICAL (10) | **2.0** | 🟢 **LOW** | Existing: Branch protection, GPG signing |
| **5** | AI-D1 (LLM04) | API rate limiting DoS | DoS | MEDIUM (3) | MEDIUM (5) | **1.5** | 🟢 **LOW** | Existing: Graceful degradation |
| **6** | T3 | Chart.js/D3.js supply chain attack | Tampering | LOW (2) | HIGH (8) | **1.6** | 🟢 **LOW** | Existing: SRI hashes, manual CDN review |
| **7** | I1 | GitHub secrets exposure | Information Disclosure | LOW (2) | CRITICAL (10) | **2.0** | 🟢 **LOW** | Existing: Secret scanning, OIDC |
| **8** | E1 | GitHub Actions privilege escalation | Elevation of Privilege | LOW (2) | MEDIUM (5) | **1.0** | 🟢 **LOW** | Existing: Least privilege, SHA-pinned actions |
| **9** | D1 | AWS infrastructure outage | DoS | LOW (2) | MEDIUM (5) | **1.0** | 🟢 **LOW** | Existing: Multi-region, GitHub Pages DR |
| **10** | AI-S1 (LLM05) | MCP server supply chain compromise | Tampering | LOW (2) | HIGH (8) | **1.6** | 🟢 **LOW** | Existing: Health checks, freshness validation |

**Average Risk Score (Top 10):** **1.99/10** (LOW)  
**Highest Risk:** **3.0/10** (AI-H1 Hallucination) → **MEDIUM**  
**Overall Threat Model Risk:** **0.69/10** (LOW) - Acceptable

### **Risk Treatment Decisions**

| Risk Treatment | Threat Count | Rationale | Annual Cost Avoidance |
|---------------|-------------|-----------|----------------------|
| **AVOID** | 0 | No threats require feature removal | N/A |
| **MITIGATE** | 48 | Active controls implemented | $180,000 |
| **TRANSFER** | 4 | AWS/GitHub vendor responsibility (Shield, GitHub SLA) | $25,000 (vendor SLA value) |
| **ACCEPT** | 18 | Residual risk within tolerance | $0 (cost of acceptance) |

### **Business Value Quantification**

**Total Annual Cost Avoidance Through Threat Model:** **$180,000**

**Breakdown by Control Category:**
- Preventive Controls: $120,000 (67%)
- Detective Controls: $40,000 (22%)
- Corrective Controls: $20,000 (11%)

**ROI Calculation:**
- Threat Model Development Cost: $15,000 (CEO/security architect time)
- Annual Security Control Costs: $8,000 (GitHub Advanced Security, AWS Shield Standard)
- **Net Annual Benefit:** $180,000 - $23,000 = **$157,000**
- **ROI:** 682% (excellent)

**Intangible Benefits:**
- ✅ Enhanced brand reputation (transparency commitment)
- ✅ Competitive advantage (public security posture)
- ✅ Customer/stakeholder trust
- ✅ Regulatory compliance (GDPR, EU AI Act, NIS2)
- ✅ Insurance premium reduction potential

---

## 🔄 Continuous Democratic Validation

Riksdagsmonitor-specific validation procedures for democratic transparency and political data integrity.

### **Democratic Data Validation Framework**

```mermaid
graph TB
    Source[🏛️ Data Source<br/>Riksdag/Regeringen]
    
    subgraph "Validation Pipeline"
        V1[📋 Schema Validation<br/>JSON structure compliance]
        V2[🔍 Freshness Check<br/><48h threshold]
        V3[✅ Document ID Verification<br/>dok_id against Riksdag API]
        V4[🗣️ Cross-Language Consistency<br/>14-language fact alignment]
        V5[📊 Statistical Plausibility<br/>Vote margin reasonableness]
        V6[🧑 Human Review<br/>PR approval gate]
    end
    
    subgraph "Publication"
        Publish[📰 Published Article]
        Reject[❌ Rejected/Corrected]
    end
    
    Source --> V1
    V1 -->|Pass| V2
    V1 -->|Fail| Reject
    V2 -->|Pass| V3
    V2 -->|Fail| Reject
    V3 -->|Pass| V4
    V3 -->|Fail| Reject
    V4 -->|Pass| V5
    V4 -->|Warning| V6
    V5 -->|Pass| V6
    V5 -->|Fail| Reject
    V6 -->|Approve| Publish
    V6 -->|Reject| Reject
    
    style Source fill:#2196f3,color:#fff
    style V1 fill:#4caf50,color:#000
    style V2 fill:#4caf50,color:#000
    style V3 fill:#ff9800,color:#000
    style V4 fill:#ff9800,color:#000
    style V5 fill:#4caf50,color:#000
    style V6 fill:#2196f3,color:#fff
    style Publish fill:#8bc34a,color:#000
    style Reject fill:#f44336,color:#fff
```

### **Validation Gate Effectiveness**

| Validation Gate | Detection Target | Detection Rate | False Positive Rate | Automation Status |
|-----------------|------------------|----------------|---------------------|-------------------|
| **V1: Schema Validation** | Malformed riksdag-regering-mcp responses | 100% | <1% | ✅ Automated |
| **V2: Freshness Check** | Stale data (>48h old) | 95% | <1% | ✅ Automated |
| **V3: Document ID Verification** | Hallucinated dok_id, fabricated documents | 85% (manual) | 2% | ⚠️ Manual (planned automation Q1 2026) |
| **V4: Cross-Language Consistency** | Contradictory facts across 14 languages | 80% (spot-check) | 5% | ⚠️ Manual (planned automation Q2 2026) |
| **V5: Statistical Plausibility** | Vote margin arithmetic errors, implausible data | 90% | 3% | ⚠️ Manual (heuristic checks) |
| **V6: Human Review** | All threat types (comprehensive gate) | 95% | 5% | ✅ Mandatory (PR review) |

**Overall Validation Effectiveness:** **92.5%** (weighted average)

**Validation Failure Rate:** **~5%** (articles rejected in PR review) - indicates healthy detection of AI hallucinations and data issues

### **Democratic Accountability Procedures**

#### Incident Response for Published Misinformation

**Severity Classification:**

| Severity | Definition | Response Time | Public Statement Required | Example |
|----------|-----------|--------------|--------------------------|---------|
| **CRITICAL** | Completely fabricated parliamentary data published | **< 4 hours** | **Yes (CEO)** | Fake vote results, non-existent proposition |
| **HIGH** | Significant factual error with reputational impact | **< 12 hours** | **Yes (project lead)** | Wrong vote margin (175-174 vs. 176-173), misattributed committee |
| **MEDIUM** | Minor factual error, limited visibility | **< 24 hours** | **No (correction notice)** | Typo in minister name, incorrect date |
| **LOW** | Stylistic issue, translation nuance | **< 72 hours** | **No (silent correction)** | Word choice in translation, formatting inconsistency |

#### Correction Protocol:

1. **Detection:** PR reviewer, user report, or automated validation failure
2. **Classification:** Assign severity (CRITICAL/HIGH/MEDIUM/LOW)
3. **Immediate Action:**
   - **CRITICAL/HIGH:** Remove article immediately (Git revert)
   - **MEDIUM/LOW:** Mark for correction (next release cycle)
4. **Investigation:** Root cause analysis (hallucination? MCP error? reviewer oversight?)
5. **Correction:** Create corrected article version with changelog
6. **Public Statement (if required):**
   - Transparent acknowledgment of error
   - Explanation of root cause (if appropriate)
   - Preventive measures implemented
   - CEO accountability signature
7. **Prevention:** Update validation gates, reviewer training, or automated checks

#### Transparency Commitment

**Public Incident Log:** All CRITICAL and HIGH severity incidents documented in GitHub Issues (public) with:
- Incident description
- Root cause analysis
- Impact assessment
- Corrective actions
- Preventive measures
- CEO accountability statement

**Example PUBLIC Incident Disclosure:**

> **Incident #2026-001: Fabricated Vote Margin Published (2026-03-15)**
>
> **Severity:** HIGH  
> **Detection:** PR reviewer post-publication (within 6 hours)  
> **Description:** AI-generated article reported incorrect vote margin (175-174) for motion H901:23. Actual margin was 176-173.  
> **Root Cause:** AI hallucination (Claude Opus 4.7 non-determinism). Document ID was correct (H901:23), but vote arithmetic was fabricated.  
> **Impact:** Misinformation visible to ~500 users before correction. No external media amplification.  
> **Corrective Actions:**
> - Article removed within 4 hours of detection
> - Corrected version published with changelog
> - Email notification to known stakeholders
>
> **Preventive Measures:**
> - Implemented automated vote margin verification against Riksdag API (Q1 2026 accelerated)
> - Enhanced PR review checklist (vote arithmetic mandatory check)
> - Reviewer training on AI hallucination detection
>
> **Accountability:** James Pether Sörling, CEO - Full responsibility for incident and prevention.

---

## 🎯 Democratic Threat Modeling Maturity

Assessment of Riksdagsmonitor threat modeling maturity per [Hack23 Threat Modeling Policy § 7](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md#maturity-model).

### **Threat Modeling Maturity Levels**

| Level | Description | Riksdagsmonitor Status | Evidence |
|-------|-------------|----------------------|----------|
| **Level 0: Ad-Hoc** | No systematic threat analysis | ❌ Not Applicable | N/A |
| **Level 1: Initial** | Basic threat identification, no formal process | ❌ Not Applicable | N/A |
| **Level 2: Managed** | STRIDE analysis, threat documentation | ❌ Superseded | Previous threat models (numbered sections) |
| **Level 3: Defined** | Formal methodology (ISMS-aligned), multi-strategy approach | ✅ **CURRENT LEVEL** | This threat model (18 thematic sections) |
| **Level 4: Quantitative** | Risk scoring, business value quantification, metrics | ✅ **CURRENT LEVEL** | Risk scores, cost avoidance ($180K), ROI 682% |
| **Level 5: Optimizing** | Continuous improvement, automated validation, AI-assisted threat modeling | 🟡 **PARTIAL** | Continuous monitoring (✅), automated validation gaps (Q1-Q2 2026) |

**Current Maturity Level:** **Level 4 (Quantitative)** with progress toward Level 5 (Optimizing)

### **Maturity Assessment by Capability**

| Capability | Maturity Level | Evidence | Gap Analysis |
|-----------|----------------|----------|--------------|
| **Threat Identification** | Level 5 ✅ | STRIDE per element, MITRE ATT&CK (23 techniques), Attack Trees (6 scenarios), OWASP LLM Top 10 | None - comprehensive coverage |
| **Risk Assessment** | Level 4 ✅ | Quantitative risk scores (0-10 scale), likelihood × impact, cost avoidance quantification | None - meets requirements |
| **Control Effectiveness** | Level 4 ✅ | Control effectiveness scoring (%), risk reduction percentages, MTTD/MTTR metrics | None - adequate metrics |
| **Business Value Integration** | Level 4 ✅ | $180K annual cost avoidance, ROI 682%, intangible benefits quantified | None - strong business case |
| **Continuous Monitoring** | Level 4 ✅ | Real-time metrics (CSP, SRI, CloudTrail), daily/weekly reviews, quarterly threat landscape updates | None - comprehensive monitoring |
| **Automated Validation** | Level 3 🟡 | Manual PR review, partial automation (schema, freshness), gaps in dok_id and cross-language validation | **GAP:** Q1-Q2 2026 automation roadmap |
| **Incident Response** | Level 4 ✅ | Documented procedures, public transparency, CEO accountability | None - mature process |
| **Threat Intelligence** | Level 4 ✅ | ENISA, MITRE ATT&CK, OWASP, Swedish CERT-SE, GitHub/AWS advisories | None - comprehensive sources |

**Overall Maturity Score:** **Level 4.25/5** (High Maturity)

**Path to Level 5 (Optimizing):**
- ✅ Complete: Formal methodology, quantitative assessment, business value, continuous monitoring
- 🟡 In Progress (Q1-Q2 2026): Automated validation (dok_id API, cross-language consistency)
- 🔄 Future (Q3-Q4 2026): AI-assisted threat modeling (LLM-based threat discovery), predictive analytics

### **Comparison to Reference Implementations**

| Metric | Riksdagsmonitor | CIA (Reference) | Black Trigram (Reference) | Industry Average (Static Websites) |
|--------|---------------------|-----------------|--------------------------|----------------------------------|
| **Document Length** | 2,134+ lines | 943 lines | 880 lines | ~300 lines |
| **Thematic Sections** | 19 sections ✅ | 18 sections | 16 sections | 5-8 sections |
| **STRIDE Threats** | 52 threats | 48 threats | 35 threats | 10-15 threats |
| **MITRE ATT&CK Techniques** | 23 techniques | 40 techniques | 28 techniques | 5-10 techniques |
| **Attack Trees** | 6 trees | 8 trees | 6 trees | 1-2 trees |
| **Control Effectiveness** | 93.1% | 92.3% | 95.8% | 70-80% |
| **Maturity Level** | **Level 4.25** | **Level 5** | **Level 4.5** | **Level 2-3** |
| **Annual Cost Avoidance** | $180,000 | $200,000+ | $150,000 | Not quantified |

**Analysis:**
- Riksdagsmonitor achieves **industry-leading maturity** for static website threat models
- Document length exceeds CIA (943 lines) and Black Trigram (880 lines) due to domain-specific sections (Democratic Threat Catalog, Frontend-Specific Security)
- Control effectiveness (93.1%) is comparable to reference implementations (92.3-95.8%)
- Maturity Level 4.25 positions Riksdagsmonitor between CIA (Level 5, mature full-stack app) and Black Trigram (Level 4.5, frontend-only game)
- **Competitive Advantage:** Public threat model transparency demonstrates security excellence to civic transparency advocates, regulators, and potential clients

---

## 🌟 Democratic Security Best Practices

Riksdagsmonitor-specific security practices for civic transparency platforms.

### **Best Practices Catalog**

#### 1. Transparency by Default 🔍

**Principle:** Publicly document all security practices, threat models, and incident responses.

**Implementation:**
- ✅ Public THREAT_MODEL.md (this document)
- ✅ Public SECURITY_ARCHITECTURE.md
- ✅ Public GitHub repository with security workflows
- ✅ Public incident disclosure policy (CRITICAL/HIGH incidents)
- ✅ CEO accountability statements

**Benefits:**
- Builds trust with transparency advocates and civil society
- Demonstrates security excellence to potential clients/partners
- Regulatory compliance (GDPR transparency, EU AI Act disclosure)
- Competitive advantage (few civic tech platforms publish threat models)

#### 2. AI Content Validation Pipeline 🤖

**Principle:** Never publish AI-generated political content without multi-layered human and automated validation.

**Implementation:**
- ✅ Document ID validation (all factual claims require valid dok_id)
- ✅ Mandatory PR review by human (95% hallucination detection)
- ✅ Source citations (MCP tool calls documented)
- ⚠️ Planned: Automated API verification (Q1 2026)
- ⚠️ Planned: Cross-language consistency validation (Q2 2026)

**Benefits:**
- Prevents AI hallucination publication (98% effectiveness)
- Maintains journalistic integrity for political data
- Regulatory compliance (EU AI Act Article 52 - transparency obligations)

#### 3. Multi-Language Integrity 🌐

**Principle:** Ensure factual consistency across all 14 supported languages.

**Implementation:**
- ✅ TRANSLATION_GUIDE.md terminology dictionary
- ✅ Translation markers (`data-translate` attributes)
- ✅ Playwright RTL testing (Arabic, Hebrew visual validation)
- ⚠️ Planned: Automated cross-language consistency validator (Q2 2026)

**Benefits:**
- Prevents narrative manipulation via translation divergence
- Maintains trust across multilingual user base
- Demonstrates commitment to linguistic accuracy

#### 4. Democratic Data Provenance 📋

**Principle:** Every factual claim must be traceable to an authoritative Swedish government source.

**Implementation:**
- ✅ Document IDs (dok_id) for all Riksdag documents
- ✅ regeringen.se URLs for all Government documents
- ✅ MCP tool call provenance (which tools generated which data)
- ✅ Git commit history (who added which content)

**Benefits:**
- Fact-checking accountability (95% verification success)
- Incident investigation capability (root cause analysis)
- Regulatory compliance (GDPR Article 5 - data accuracy)

#### 5. Civic Technology Resilience 🛡️

**Principle:** Democratic transparency platforms must be resilient to nation-state attacks and election-period disruptions.

**Implementation:**
- ✅ Multi-region architecture (AWS us-east-1 + eu-west-1, GitHub Pages DR)
- ✅ AWS Shield Standard (DDoS protection)
- ✅ Route 53 health checks (automatic failover)
- ✅ AI content freeze protocol (election periods)
- ✅ Incident response playbook (CEO-led)

**Benefits:**
- 99.998% availability target met
- <5 minute recovery from regional failures
- Maintains transparency during high-stakes political events

---

## 📚 Related Documents

### **Riksdagsmonitor Documentation**

- [🏛️ Architecture](./ARCHITECTURE.md) - C4 models (Context, Container, Component)
- [🔐 Security Architecture](./SECURITY_ARCHITECTURE.md) - Comprehensive security controls implementation (CSP, SRI, IAM, OIDC)
- [🔮 Future Threat Model](./FUTURE_THREAT_MODEL.md) - Threat analysis for planned architecture evolution
- [📊 Data Model](./DATA_MODEL.md) - Political data entities and relationships
- [🔄 Workflows](./WORKFLOWS.md) - CI/CD security workflows, GitHub Actions
- [📈 State Diagram](./STATEDIAGRAM.md) - System state transitions
- [🧠 Mindmap](./MINDMAP.md) - System conceptual relationships
- [💼 SWOT](./SWOT.md) - Strategic analysis
- [🗺️ Translation Guide](./TRANSLATION_GUIDE.md) - 14-language terminology dictionary
- [🤖 Agents](./AGENTS.md) - AI agentic workflows documentation

### **Hack23 ISMS Policies (Public)**

#### Core Security Policies:
- [🎯 Threat Modeling Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md) - Comprehensive methodology (5-strategy approach)
- [🔐 Secure Development Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) - SDLC security requirements
- [🏷️ Classification Framework](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) - CIA triad business impact analysis
- [📉 Risk Register](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Risk_Register.md) - Enterprise risk management
- [🤖 AI Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) - LLM application security requirements
- [🔒 OWASP LLM Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md) - LLM Top 10 controls
- [🔓 Open Source Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) - OSS governance, security posture evidence
- [🛡️ CRA Conformity Assessment Process](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CRA_Conformity_Assessment_Process.md) - CRA self-assessment methodology

#### Compliance Frameworks:
- [📋 ISO 27001:2022 Controls](https://github.com/Hack23/ISMS-PUBLIC/blob/main/ISO_27001_Annex_A.md) - Annex A control mapping
- [🔵 NIST CSF 2.0 Mapping](https://github.com/Hack23/ISMS-PUBLIC/blob/main/NIST_CSF_Mapping.md) - Cybersecurity Framework alignment
- [🟠 CIS Controls v8.1](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CIS_Controls_v8.1.md) - Critical security controls
- [📊 GDPR Compliance](https://github.com/Hack23/ISMS-PUBLIC/blob/main/GDPR_Compliance.md) - Data protection requirements
- [🇪🇺 EU AI Act Compliance](https://github.com/Hack23/ISMS-PUBLIC/blob/main/EU_AI_Act_Compliance.md) - AI regulatory alignment

### **Reference Implementations**

- [🏛️ CIA Threat Model](https://github.com/Hack23/cia/blob/master/THREAT_MODEL.md) - Full-stack web application (Java/Spring Boot + PostgreSQL + AWS)
- [🎮 Black Trigram Threat Model](https://github.com/Hack23/blacktrigram/blob/main/THREAT_MODEL.md) - Frontend gaming application (React + Vite + Phaser.js)
- [📊 CIA Compliance Manager Threat Model](https://github.com/Hack23/cia-compliance-manager/blob/main/THREAT_MODEL.md) - Compliance dashboard (React + AWS)

### **External Frameworks & Threat Intelligence**

- [🎭 STRIDE (Microsoft)](https://en.wikipedia.org/wiki/STRIDE_(security)) - Threat categorization framework
- [🎖️ MITRE ATT&CK Framework](https://attack.mitre.org/) - Adversary tactics and techniques
- [🛡️ OWASP Top 10](https://owasp.org/www-project-top-ten/) - Web application security risks
- [🤖 OWASP LLM Top 10](https://owasp.org/www-project-top-10-for-large-language-model-applications/) - LLM application vulnerabilities
- [🇪🇺 ENISA Threat Landscape 2024](https://www.enisa.europa.eu/publications/enisa-threat-landscape-2024) - Current cyber threats
- [🔍 OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling) - Best practices
- [🇸🇪 Swedish CERT-SE](https://www.cert.se/) - National cybersecurity authority

---

## 📋 Document Control

**📋 Document Owner:** James Pether Sörling, CEO & CISO  
**📄 Version:** 1.0  
**📅 Last Updated:** 2026-02-15 (UTC)  
**✅ Approved by:** James Pether Sörling, CEO  
**🔄 Review Cycle:** Quarterly (Feb, May, Aug, Nov)  
**⏰ Next Review:** 2026-05-15  
**🏢 Owner:** Hack23 AB (Org.nr 5595347807)  
**📤 Distribution:** Public  
**🏷️ Classification:** [![Confidentiality: Public](https://img.shields.io/badge/C-Public-lightgrey?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#confidentiality-levels) [![Integrity: High](https://img.shields.io/badge/I-High-orange?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#integrity-levels) [![Availability: High](https://img.shields.io/badge/A-High-orange?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md#availability-levels)

### **Framework Compliance**

**🎯 Framework Alignment:**  
[![ISO 27001](https://img.shields.io/badge/ISO_27001-2022_Compliant-blue?style=flat-square&logo=iso&logoColor=white)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) [![NIST CSF 2.0](https://img.shields.io/badge/NIST_CSF-2.0_Aligned-green?style=flat-square&logo=nist&logoColor=white)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) [![CIS Controls](https://img.shields.io/badge/CIS_Controls-v8.1_Aligned-orange?style=flat-square&logo=cisecurity&logoColor=white)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/CLASSIFICATION.md) [![OWASP](https://img.shields.io/badge/OWASP-LLM_Top_10_Compliant-purple?style=flat-square&logo=owasp&logoColor=white)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/OWASP_LLM_Security_Policy.md) [![EU AI Act](https://img.shields.io/badge/EU_AI_Act-Limited_Risk_Compliant-darkblue?style=flat-square)](https://github.com/Hack23/ISMS-PUBLIC/blob/main/EU_AI_Act_Compliance.md)


---

## 🌐 IMF Integration — STRIDE Threats (Current State)

> **Effective:** 2026-04-24 · **Authoritative hub:** [`analysis/imf/README.md`](analysis/imf/README.md) · [`analysis/imf/agentic-integration.md`](analysis/imf/agentic-integration.md) · [`analysis/imf/indicators-inventory.json`](analysis/imf/indicators-inventory.json) · [`analysis/imf/data-dictionary.md`](analysis/imf/data-dictionary.md) · [`.github/aw/ECONOMIC_DATA_CONTRACT.md`](.github/aw/ECONOMIC_DATA_CONTRACT.md)

### IMF-specific STRIDE threats

| ID | Element | STRIDE | Description | Likelihood | Impact | Mitigation |
|---|---|---|---|---|---|---|
| **T-IMF-01** | IMF cache (filesystem) | **T**ampering | Vintage substitution — older WEO vintage swapped for newer label | LOW | HIGH | Vintage-tagged filenames; SHA-256 pin in cache index; supersedes-chain audit |
| **T-IMF-02** | IMF egress path | **I**nformation disclosure | None — IMF data is public macro statistics; no PII; no credentials transmitted | N/A | N/A | Risk eliminated by design |
| **T-IMF-03** | IMF API | **D**oS | Workflow exceeds IMF rate limit (~30 req/min) → blocks article generation | MEDIUM | MEDIUM | Cache-first; self-imposed ≤30 req/min; exponential back-off; documented in `analysis/imf/agentic-integration.md` |
| **T-IMF-04** | IMF citation in article | **R**epudiation | Article cites "IMF projects X" without vintage label → unauditable claim | MEDIUM | MEDIUM | `economicProvenance` block required in front-matter; ECONOMIC_DATA_CONTRACT v2.1 banned phrases |
| **T-IMF-05** | `tsx scripts/imf-fetch.ts` | **E**levation of privilege | Supply-chain tampering of IMF fetch script | LOW | HIGH | Script in-repo; reviewed; no dynamic eval; harden-runner egress audit |
| **T-IMF-06** | IMF data licence | **R**epudiation | Article reuses IMF figure without attribution | LOW | MEDIUM | Article footer template auto-emits IMF citation; lint enforces |
| **T-IMF-07** | IMF cache fallback | **S**poofing | Stale cached vintage served as current → reader misinformed | LOW | MEDIUM | Vintage-age annotation rule (>6 mo → flagged); ECONOMIC_DATA_CONTRACT v2.1 |

### IMF mitigations cross-reference

All mitigations are codified in:
- `analysis/imf/data-dictionary.md` — vintage discipline + dataflow quirks
- `analysis/imf/agentic-integration.md` — seven-step integration contract
- `.github/aw/ECONOMIC_DATA_CONTRACT.md` — banned phrases + provenance schema
- `scripts/imf-context.ts` — runtime enforcement
- `tests/imf-context.test.ts` + `tests/imf-inventory.test.ts` — regression prevention

**Egress hosts** (allow-list): `www.imf.org` (Datamapper REST · WEO/FM), `sdmxcentral.imf.org` (SDMX 3.0 REST · IFS/BOP/DOTS/GFS/PCPS/ER/MFS_IR/MFS_PR). Both HTTPS-only, anonymous, public — no credentials required.

**Canonical rule.** Every economic claim in a Riksdagsmonitor article cites an IMF dataflow first; World Bank citations are reserved for governance, environment and social residue (the classes IMF does not publish). SCB is the Swedish-specific ground truth layer. See `ECONOMIC_DATA_CONTRACT.md` v2.1 for the banned-phrase list and vintage discipline (>6 mo → annotation).

---

## 🏛️ Statskontoret Integration — STRIDE Threats

> **Effective:** 2026-04-25 · **Classification:** Public · **Entry point:** `scripts/statskontoret-fetch.ts` · **Source:** `www.statskontoret.se`.

Statskontoret ingestion introduces a public-data trust boundary for Swedish agency structure and budget outturn files. It is unauthenticated, read-only and optional enrichment, but the integrity of parsed figures matters for political-intelligence claims.

| ID | Asset / flow | STRIDE | Threat | Likelihood | Impact | Mitigations |
|---|---|---|---|---|---|---|
| T-STATS-01 | `www.statskontoret.se` page discovery | Spoofing | DNS/TLS interception or lookalike page returns false download links | LOW | MEDIUM | HTTPS-only egress, allow-list `www.statskontoret.se`, source URL recorded in payload and `.meta.json`, PR review of persisted diffs. |
| T-STATS-02 | Excel / CSV ZIP payload | Tampering | Workbook or archive content modified upstream or in transit | LOW | HIGH | TLS transport, local parser contract checks, typed `StatskontoretError`, persisted raw/derived artifacts with provenance sidecars, reviewer diff inspection. |
| T-STATS-03 | Headcount aggregation | Information integrity | Header drift maps wrong columns to `År`, `Departement`, `Myndighet`, or `Årsarbetskrafter` | MEDIUM | MEDIUM | Header-family matching documented in `analysis/statskontoret/data-dictionary.md`, unit tests for workbook parsing and Swedish number handling, fallback to no derived output if required fields cannot be resolved. |
| T-STATS-04 | CLI invocation | Repudiation | Article cites agency headcount or budget outturn without source page/year/status | MEDIUM | MEDIUM | `discover` captures source page, URL, year/month/status and `last-modified`; persisted sidecars include `dataset`, `artifact`, `fetchedAt`, and `mcpTool: statskontoret-ts-client`. |
| T-STATS-05 | Source availability | Denial of service | Statskontoret page unavailable or workbook fetch times out | MEDIUM | LOW | 15s timeout, optional-enrichment semantics, cache-first reuse of `analysis/data/statskontoret/`, article generation can omit context rather than fail. |
| T-STATS-06 | XLSX/ZIP parsing dependency | Elevation of privilege | Malicious archive attempts parser/resource abuse | LOW | HIGH | `jszip` pinned in npm lock/SBOM, GitHub Advisory Database reviewed, no dynamic eval, no script execution from workbooks, tests exercise parser edge cases. |

### Residual risk and classification

- **Residual risk:** LOW-MEDIUM integrity risk due to upstream data or workbook-schema drift; handled by provenance, test coverage and human review.
- **Privacy:** no PII or credentials; public authority and aggregate budget data only.
- **CIA:** Public / High Integrity / Medium-High Availability for derived article context.