Fix THREAT_MODEL.md MFA status discrepancy — MFA marked as "Planned" but is implemented

[pethers]

🎯 Objective

Correct the THREAT_MODEL.md documentation to accurately reflect that Multi-Factor Authentication (MFA) via Google Authenticator is fully implemented, not "Planned".

📋 Background

Cross-referencing security documentation with actual code reveals a critical discrepancy:

Document	MFA Status
SECURITY_ARCHITECTURE.md	"Implemented" ✅
THREAT_MODEL.md	"Planned" ❌ (incorrect)
Actual Code	✅ Implemented — SetGoogleAuthenticatorCredentialService.java, DisableGoogleAuthenticatorCredentialService.java exist

This discrepancy undermines documentation credibility and may cause incorrect risk assessments during security audits. ISMS compliance (ISO 27001 A.5.17) requires accurate documentation of authentication controls.

📊 Current State (Measured Metrics)

• THREAT_MODEL.md: 958 lines, references MFA as "Planned" in mitigation sections
• SECURITY_ARCHITECTURE.md: 1,560 lines, correctly documents MFA as "Implemented"
• Code evidence:
  • SetGoogleAuthenticatorCredentialService.java — enables MFA for user accounts
  • DisableGoogleAuthenticatorCredentialService.java — disables MFA credentials
  • VaultManager — manages Google Authenticator credential storage
  • Spring Security @Secured annotations protect MFA endpoints
• ISMS_COMPLIANCE_MAPPING.md: 32 policies mapped but MFA status not cross-validated

✅ Acceptance Criteria

• THREAT_MODEL.md updated: MFA status changed from "Planned" to "Implemented" in all occurrences
• Cross-reference links added to implementation files (SetGoogleAuthenticatorCredentialService, DisableGoogleAuthenticatorCredentialService)
• STRIDE analysis mitigation table updated to reflect implemented MFA control
• Consistency verified between THREAT_MODEL.md, SECURITY_ARCHITECTURE.md, and ISMS_COMPLIANCE_MAPPING.md
• All three security docs agree on MFA implementation status
• GuardDuty/Security Hub references verified for accuracy (separate finding: claims may lack implementation evidence)

🛠️ Implementation Guidance

Files to Modify:

• THREAT_MODEL.md — update MFA status from "Planned" to "Implemented" across all sections
• Verify ISMS_COMPLIANCE_MAPPING.md — ensure MFA control is listed with correct status
• Verify SECURITY_ARCHITECTURE.md — confirm it remains accurate (currently correct)

Approach:

1. Search THREAT_MODEL.md for all MFA/multi-factor/Google Authenticator references
2. Update status from "Planned" to "Implemented" with evidence references
3. Add implementation evidence: file paths to credential service classes
4. Cross-check all three security documents for consistency
5. Verify GuardDuty/Security Hub claims have implementation evidence (flag if not)

🤖 Recommended Agent

Agent: @hack23-isms-ninja
Rationale: This is a security documentation alignment task requiring ISMS compliance expertise and cross-document consistency verification.

For implementation, the ISMS Ninja will:

• Audit all security documents for MFA status references
• Update THREAT_MODEL.md with correct implementation status
• Verify cross-document consistency per ISO 27001 documentation requirements
• Add evidence links to actual implementation files