Hi 0x00’ers!
Depending on your level of skill, you may be under the impression that using a VPN for all your traffic is a good thing for your privacy, you’ll have been told that using Tor 24/7, or tunneling all your traffic through it may save you from the infamous 3 letter agencies. Whatever crud you’ve been told, it’s time to forget it, and make up your own mind before blindly accepting the next big privacy fad.
If you speak to any well-practiced security guy (or girl, I’m not judging), they will all tell you one thing:
What is a threat model? The definition straight outta Wikipedia mentions the following:
To make your threat model, you have to think about a few things. Your threat model can be applied to anything, your physical infiltration threats or your network infiltration threats. In this article, I am going to talk about computer based threats.
In blue team security, there are a number of different methodologies that have been created for companies and people to give people a methodical way to do things.
One of these is STRIDE, a threat classification model developed by Microsoft
It follows 5 threat categories as a mnemonic:
- Spoofing of user identity
- Tampering
- Repudiation
- Information disclosure (privacy breach or data leak)
- Denial of service (D.o.S)
- Elevation of Privilege
1. Who is a threat to you?
This is a big and very open ended question, but in short, who poses a threat to you, your safety, your information and/or your assets.
For a corporation, this is nearly always Blackhats, or rogue employees with a vendetta, however for an individual like yourself, it can be anything from Blackhats to the three letter agencies that you hear ranted about daily.
This step is very important to get right, if you don’t know who you’re protecting against, you will never protect yourself adequately.
2. What am I vulnerable to?
Now you know who you are defending against, you need to step into the shoes of your adversary, personally, my threat model revolves around Blackhats.
Look at yourself completely honestly, if you were a hacker, how would you go about compromising you, what pieces of tech do you have exposed, how might an attacker socially engineer you?
For most, social engineering is one of the leading vulnerabilities that we can all exhibit, one thing that can help our case significantly is our OPSEC, knowing what we can and can not reveal will give our attackers a hard time finding anything to use as leverage.
3. What are my high-value assets?
Have some information somebody might want? Have access to some server or physical location that might paint a target on your back?
Thinking about solutions
After thinking about all the potential threats, vulnerabilities, and targets relating to you, you must start thinking about how to remedy these, or give you a better chance. As I have already mentioned, this may be through Opsec, using stronger passphrases, or even using a VPN.
But wait, you’ve just told me that Tor and VPN’s are bad?
What services you use, where you route your traffic and how, is due to your threat model. Are you trying to hide your location and IP from criminal attackers? If so, a VPN and or Tor may actually increase your security posture.
Are you trying to hide from the NSA? A VPN or Tor may actually do the exact opposite, this depends entirely on your trust of an organization, but if you look at it from a full no-trust POV, you’re essentially just tunnelling all your traffic through a company that might not even nee subpoena to reveal.
Conclusion
In conclusion then, being aware of your threats, your vulnerabilities, and your adversaries will give you a firm basis for continuing to develop your Opsec, your Security, and what you choose (and choose not) to do in your day to day activities.
I hope this was helpful! If you have anything to add, or to disagree with me on anything, throw down a comment, if you enjoyed this, give me a like, and comment your opinion!
Do you have a threat model? What do you protect against?
Stay Snappy 
- pry0cc