BRIEF / 01.A.01
Confidential documents and administrative powers
A shared archive holds confidential information. The design must specify which documents a user can read, what powers administrators hold and how copies are protected. A compromised administrator account must also be assessed for the permissions it can change.
BRIEF / 01.A.02
Who can read, export and recover documents
The Threat Model identifies which access rights are considered compromised and which consequences must be contained. The design defines who can decrypt, export or recover documents and which boundaries must remain effective.
BRIEF / 01.A.03
Separate storage, identities and keys
Storage, identities, key use and recovery are assessed as distinct trust domains. Separation is effective only if administrative powers cannot indirectly reconstruct access to the information. Copies, metadata and exports belong in the same scope.
BRIEF / 01.A.04
Configure access, keys and copies
Cerberox selects and integrates archive components, configures identities and permissions, and implements the agreed key management, sharing and copies. It checks that administrative privileges do not bypass required separations. Design changes are approved before implementation and recorded in the final documentation.
| Requirement | Storage administration privileges alone must not permit archive decryption. |
|---|---|
| Engineering and implementation | Configure identities, privileges, key custody and recovery to preserve the required separation. |
| Planned test | Check access and the administrator account’s indirect capabilities over identities, keys, the authorised process and recovery. |
| Handover materials | Relevant configurations, test conditions and result, remaining capabilities, limits and unverified aspects. |
BRIEF / 01.A.05
Access and recovery tests
Checks start with the actual capabilities of the identities in scope: which documents they can obtain, which permissions they can change and which alternative paths they can use. Agreed tests include allowed and denied access and recovery of usable content.
BRIEF / 01.A.06
Authorised devices and copies already exported
Separating storage administration from decryption does not remove exposure through a device or application authorised to process plaintext. Revoking access does not withdraw copies already obtained. These limits inform the decisions and project documentation.