# Data threat model

As the client's features leverage storage technologies.
Tt must be examined what storage-related threats can be expected.

## Threats categorized

1. Data loss because of storage hardware failure.
1. Malicious party destroys data though Nano.

## Possible impact of exploiting the threats

1. Storage hardware failure.

    The storage hardware has to be redundant to survive eventual failure of some parts of it. Common solutions are
    live redundancy with RAID technologies or frequent and periodic backups. This is an inherent issue of storing
    any data.
    
    Depending on the value of the stored data such event can be catastrophic.

1. A malicious user or party may abuse their access to a Nano to destroy data.

    See (4) in net-threat-model.

    Depending on the value of the stored data such event can be catastrophic.

## Threat mitigations

1. Nano is independent of the used storage technologies and hardly imposes any restrictions about them. This design
has been chosen so it can be usable in a wide variety of systems. For this reason even though Nano uses storage it
does not manage it. It uses the most common abstraction of OS filesystem access to use them and does not know what
the storage architecture is most of the time.

    To mitigate the impact of storage failures the owner/administrator of the machine must choose, setup and manage
    the storage technologies of their choice.

1. Dealing with an abusive member of the group is outside of the scope of Nano. See (4) in net-threat-model.

    An extra step that could be taken is to have a recycle-bin feature where deleted content remains recoverable for
    some time. For this feature to be safe not only deleting content but overwriting and changing it must also be
    managed. This system could be abused by an attacker to achieve DoS on the storage.
    
    There are storage technologies that support snapshots. These are commonly referred to as volume managing
    filesystems. Effectively they provide optimal solutions to restore maliciously destroyed data if managed correctly.
    Such systems should be used by the storage administrator to mitigate malicious content manipulations. Nano being a
    user-space application could never solve these issues so optimally as filesystems which have this integrated.

## Mitigation evaluation

Both (1) and (2) are considered out of the scope and are not responsibilities of Nano. There are numerous solutions
administrators can choose to use as they see fit to mitigate the possibility of data loss.

See (4) in net-threat-model for additional information on abuse by legitimate user.

## Conclusion

Nano is not a data backup system, it does not care about the storage of the data. Making the storage safe and
resilient to failure or abuse is the responsibility of the owner of the data-storage.
