Threat Model

Before making decisions on what services and products you need for security and privacy matters, you need to assess your personal threat model - that is, to get that balance between what you actually need and what you don’t.

For example, I do not use my Windows computer on a regular basis, and when I do, I use it exclusively for gaming. This means I very rarely expose the PC to situations where viruses could infiltrate the system as web browsing is limited and software installed through verified sources. It also means that I do not have sensitive information on the device, nor is it connected to my NAS which has important files on there. As such, I may see little benefit in installing a suite of anti-virus and security measures onto the machine.

However, if I instead browsed “dodgy” websites, had valuable files and information on the drive, and installed software from a wide-range of sources which may not be verified, I would probably need significantly more protection on that PC.

Knowledge is also important to consider. I have relatives who are not tech savvy, so while they may not engage in deliberately risky behaviour online, they may make mistakes such as downloading from incorrect places or opening scam emails they believe to be sent from someone trusted, which puts them at risk.

Privacy Guides goes in-depth here on what threat modelling is and how you can work out what your risk level is.

This is important to work through as it is hard to give a blanket answer to many questions, such as “Do I need a VPN?” without taking your personal treat model into account. You may not need one, you may want one occasionally, you may find a VPN to be essential, for example.

As such, in each guide, I will try to mention possible scenarios where someone at a certain level of risk may want service X or product Y, but whenever I talk about such things, please always keep in mind your personal threat model, as the information may or may not be relevant to you.