Threat Modeling
- •
What it is
- •
The process of identifying what you need to protect, from whom, how likely an attack is, how bad the consequences would be, and how much effort you're willing to spend to prevent it — used to decide which security/privacy trade-offs are actually worth making for you specifically.
- •
- •
Why it matters
- •
No tool is ever fully secure, and the most secure tools are usually the least convenient. Trying to defend against every possible threat is both impossible and paralyzing. Threat modeling narrows the problem down to the threats that are actually plausible for your situation, so effort goes where it matters instead of being spread thin or wasted on threats you'll never realistically face.
- •
- •
How it works
- •
Answer five questions:
- •
What do I want to protect? -> your Asset (concept) s.
- •
Who do I want to protect it from? -> your adversaries
- •
How likely am I to need to protect it? -> your Risk.
- •
How bad are the consequences if I fail? -> depends on adversary capability and motive.
- •
How much trouble am I willing to go through to prevent it? -> your personal cost/convenience tolerance.
- •
- •
- •
Example
- •
An attorney handling a national-security case has high-value assets, a capable and motivated adversary, and severe consequences if compromised — so they're willing to use encrypted email and other high-friction tools. A parent emailing cat videos to her daughter has the same theoretical threats available in principle, but low risk and low stakes, so heavy security measures aren't worth the trouble for her.
- •
- •
- •
Cards