docs/security/threat-model.md
This document describes the threat model for the Jaeger distributed tracing system.
Jaeger is a distributed tracing platform that collects, processes, and visualizes trace data from instrumented applications. This threat model identifies potential threats and the controls implemented to mitigate them.
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Instrumented │ │ Jaeger │ │ Storage │
│ Applications │─────▶│ Collector │─────▶│ Backend │
│ (OTel SDK) │ │ │ │ (ES/Cassandra) │
└─────────────────┘ └─────────────────┘ └────────┬────────┘
│
┌─────────────────┐ │
│ Jaeger │◀──────────────┘
│ Query + UI │
└────────┬────────┘
│
┌────────▼────────┐
│ Users │
│ (Browser) │
└─────────────────┘
| Boundary | Description | Security Controls |
|---|---|---|
| B1: SDK → Collector | External applications sending spans | TLS/mTLS, rate limiting, schema validation |
| B2: Collector → Storage | Internal service to database | TLS, authentication, authorized credentials |
| B3: Storage → Query | Database to internal service | TLS, authentication, read-only access |
| B4: Query → Users | Internal service to end users | TLS, bearer tokens, RBAC |
| Actor | Description | Motivation |
|---|---|---|
| Malicious Application | Compromised or rogue service sending traces | Data poisoning, DoS, information injection |
| External Attacker | Attacker with network access | Data exfiltration, reconnaissance, DoS |
| Malicious Insider | User with legitimate access | Unauthorized data access, privilege escalation |
| Man-in-the-Middle | Attacker on network path | Data interception, tampering |
Description: Malicious or misconfigured application sends excessive spans.
| Attribute | Value |
|---|---|
| Threat Actor | Malicious Application |
| Impact | High - Can overwhelm collector and storage |
| Likelihood | Medium |
Mitigations:
Description: Traces may inadvertently contain sensitive data (PII, credentials).
| Attribute | Value |
|---|---|
| Threat Actor | External Attacker, Malicious Insider |
| Impact | High - Data breach |
| Likelihood | Medium |
Mitigations:
Description: Attacker intercepts unencrypted trace traffic.
| Attribute | Value |
|---|---|
| Threat Actor | Man-in-the-Middle |
| Impact | High - Data interception and tampering |
| Likelihood | Low (with TLS) |
Mitigations:
Description: Unauthorized user accesses the Query UI/API.
| Attribute | Value |
|---|---|
| Threat Actor | External Attacker, Malicious Insider |
| Impact | Medium - Information disclosure |
| Likelihood | Medium |
Mitigations:
Description: Attacker gains access to the storage backend directly.
| Attribute | Value |
|---|---|
| Threat Actor | External Attacker |
| Impact | High - Full data access |
| Likelihood | Low |
Mitigations:
Description: Compromised dependency introduced into build.
| Attribute | Value |
|---|---|
| Threat Actor | External Attacker |
| Impact | Critical - Code execution |
| Likelihood | Low |
Mitigations:
tls.insecure: false for all connections