What is Threat Modeling?
Threat modeling is a structured process for identifying security threats and vulnerabilities, then determining countermeasures to prevent or mitigate their effects. It answers four fundamental questions:
- What are you protecting? (Assets)
- Who are you protecting it from? (Adversaries)
- How likely is it you'll need to protect it? (Risk)
- What are the consequences if you fail? (Impact)
Identify Your Assets
Assets are anything you want to protect. In digital privacy, these typically include:
Identity
Real name, address, photo, biometrics
PersonalCommunications
Emails, messages, call records
DataLocation
Home, work, travel patterns
PhysicalFinancial
Bank accounts, transactions, assets
FinancialRelationships
Contacts, associates, networks
SocialActivities
Browsing history, interests, habits
BehavioralKnow Your Adversaries
Different adversaries have different capabilities, motivations, and resources:
| Adversary | Capability | Motivation | Resources |
|---|---|---|---|
| Corporations | High | Profit (advertising, data sales) | Massive |
| Governments | Very High | National security, law enforcement | Unlimited |
| Hackers | Variable | Financial gain, reputation | Limited-High |
| ISPs | Medium | Profit, legal compliance | Medium |
| Personal | Low-Medium | Personal vendetta, stalking | Limited |
Key Insight: You don't need to defend against everyone. Focus on adversaries relevant to your situation. A journalist protecting sources has different threats than someone avoiding targeted ads.
Assess Risk
Risk is calculated as: Risk = Likelihood à Impact
Likelihood Factors
- How valuable is your data to the adversary?
- How visible are you as a target?
- How easily can the attack be performed?
- What's the adversary's track record?
Impact Factors
- What happens if this information is exposed?
- Can the damage be reversed?
- Who else might be affected?
- What are the legal implications?
LOW IMPACT HIGH IMPACT
LOW RISK â Accept â Monitor
HIGH RISK â Mitigate â PrioritizeChoose Countermeasures
For each high-priority risk, select appropriate defenses:
Avoid
Don't create the risk in the first place. Don't collect data you don't need. Don't use services that track you.
Mitigate
Reduce likelihood or impact. Use encryption, Tor, VPNs, secure messaging. Compartmentalize identities.
Transfer
Shift risk to others. Use services with strong privacy guarantees. Insurance for some risks.
Accept
Some risks aren't worth the cost of mitigation. Document accepted risks and revisit periodically.