Threat modelling and secure configuration

Security can feel like an endless list of warnings. Professionals handle it by asking three plain questions: what am I protecting, what could go wrong, and what will I do about it? Answering them in order is called threat modelling, and you can do it on one sheet of paper. It stops you from spending effort on unlikely dangers while the obvious ones stay open. This lesson teaches the method and then the practical habit of changing risky default settings.

Thinking like a defender

Cybersecurity is the work of protecting computers, accounts and data from harm. There is no such thing as perfect security. The aim is to make harm unlikely enough, and small enough, that you can live with what is left. A bank vault and a garden shed need different locks. The sensible question is never how do I make everything impossible to attack, but what matters here and how much protection does it deserve.

Earlier lessons named a Threat as something that could cause harm, a Vulnerability as a weakness it could use, and a Risk as the chance and size of the harm. Threat modelling puts those three words to work in a fixed order.

The four questions of a threat model

A Threat model is a short written answer to four questions. Write it for a small system you know well, such as your home laptop and phone, or Joseph's shop with its till laptop and Wi-Fi.

Step 1: assets

An Asset is anything of value that you want to protect. It may be data (customer orders, family photos), an account (email, bank), a device (the till laptop) or a service (the shop's Wi-Fi). Also note the property that matters most: confidentiality (only the right people can see it), integrity (it has not been altered) or availability (it is there when you need it). Photos need availability and confidentiality. A price list needs integrity.

Step 2: threats and risk

For each asset, list what could harm it. Include non-criminal causes: a dropped laptop, a flat battery and a spilt drink are all more common than a hacker. Then give each threat a rough rating for how likely it is and how bad the harm would be: low, medium or high. Multiply them in your head. A likely threat with a bad outcome is a high risk and goes to the top of the list.

Step 3: mitigations

A mitigation is an action that lowers a risk. Start with the high risks. For the order spreadsheet the mitigation is a tested backup. For the email account it is a strong unique password in a Password manager plus Multifactor authentication (MFA). For Wi-Fi it is changing the router's default password. Choose cheap, boring fixes first. They remove most of the risk for very little effort.

Defence in depth: more than one lock

No single protection is perfect, so good security uses several, one behind another. This is Defence in depth. A house has a fence, a locked door and a safe. If a thief gets past the fence, the door is still there. For an email account the layers are a strong password, multifactor authentication, a phishing-aware owner, recovery codes kept safe and a way to notice strange activity. Each layer catches what the one before it missed.

Secure configuration and default settings

Many break-ins need no clever trick, only a setting that was left as it came. A Secure default is a setting that is safe from the start. Devices do not always ship that way. Routers may use a well-known administrator password printed on the label, programs may start with sharing turned on, and old accounts may still exist. Changing risky settings to safe ones is called hardening, and it reduces the Attack surface: the number of places where something could go wrong. Fewer open doors means fewer doors to guard.

ss -tuln

Netid State  Recv-Q Send-Q Local Address:Port Peer Address:Port
udp   UNCONN 0      0      127.0.0.53%lo:53    0.0.0.0:*
tcp   LISTEN 0      4096   127.0.0.53%lo:53    0.0.0.0:*

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort | Sort-Object LocalPort