Most security advice is a pile of unranked instructions that leaves people either overwhelmed or falsely confident. Professionals do not work from lists. They work from a threat model — a short, honest answer to what you have, who would want it, and what they would realistically do. Here is how to build yours in an hour.
Security Researcher • Penetration Tester
Tarun Jaswani writes about technology and security for everyday people — the practical habits that keep ordinary lives safe online, explained without jargon and always from the side of the person trying to protect themselves.
Ask most people what they do for security and you get a list. Strong passwords. Antivirus. Do not click strange links. Use a VPN. Cover the webcam. Every item might be reasonable in isolation, but a list is not a strategy — it has no order, no reasoning, and no way of telling you which three things actually matter for your life versus which seven are folklore. That is why people either do everything badly or do a few random things well and assume they are covered.
https://about.me/tarun_jaswani
Security professionals do not start with a list. They start with a threat model: a structured answer to four questions about the specific situation being defended. It is not complicated, it does not require technical knowledge, and doing it once produces a personal priority order that makes every subsequent decision easier.
https://medium.com/@rajkarar814/how-cybersecurity-can-change-the-world-dd4cd368c346
Question One: What Do You Actually Have That Is Worth Taking.
Not "my data" in the abstract. Specifically: money and the ability to move it, accounts that control other accounts, identity documents that enable impersonation, private communications and photographs, professional access such as work systems or client data, and anything with sentimental irreplaceability like family photos with no backup.
Write the list. Most people are surprised by how short it is and how much of it funnels through two or three accounts. That concentration is the most useful thing the exercise reveals, because it tells you exactly where effort belongs.
Question Two: Who Would Realistically Want It.
This is where most people get security wrong in both directions. They either imagine a targeted expert adversary, panic, and give up — or they imagine nobody cares about them and do nothing. Both are wrong for almost everyone.
• Opportunistic criminals running automated attacks at scale. They do not know or care who you are. They test leaked credentials, blast phishing messages, and take whatever opens. This is the overwhelming majority of what ordinary people face.
• Scammers using social engineering — fake delivery notices, fake bank calls, fake job offers, romance and investment fraud. Their tool is your emotional state, not your technology.
• People who know you. Uncomfortable but real: an ex-partner, a family member, a colleague. They have context, physical access, and answers to your security questions. For many people this is the most likely serious threat.
• Targeted attackers with resources. Genuinely relevant if you are a journalist, activist, executive with signing authority, or someone holding significant crypto assets. Not relevant to most people, and pretending otherwise mostly produces paralysis.
https://x.com/TJaswani7857
Question Three: How Bad Is It If They Succeed.
Rank the consequences honestly, because not all compromises are equal. Losing a streaming account is annoying. Losing your primary email is catastrophic, because it resets everything else. Losing your banking app is immediately expensive. Losing private photographs may be unrecoverable in a way money is not.
Multiply likelihood by consequence and a priority order falls out on its own. High likelihood plus high consequence is where all your early effort goes. Low likelihood plus low consequence is where good advice goes to be safely ignored.
Question Four: What Are You Realistically Willing to Sustain.
A security practice you abandon in three weeks provides no protection. The correct measure of a control is not how strong it is in theory but how strong it is after twelve months of your actual behaviour. A password manager you use for everything beats a memorised scheme you abandon under pressure. Two-factor on five critical accounts that you keep enabled beats two-factor on forty accounts that you disable in frustration.
Choose controls you will still be using next year. This single filter eliminates most of the elaborate advice that circulates online, and it is why professionals recommend boring, durable measures over clever fragile ones.
https://www.linkedin.com/in/tarun-jaswani-a85b55401/
What the Model Produces for Almost Everyone.
Run those four questions for a typical person with a job, a family, a bank account, and normal public exposure, and the same short priority list emerges nearly every time:
- Protect the primary email above everything, because it is the reset path for the rest of your life. Unique password, app-based or hardware two-factor, recovery options cleaned up.
- Use a password manager and stop reusing passwords. Credential stuffing — attackers trying breached passwords across other sites — is the single most common way ordinary accounts fall, and unique passwords defeat it entirely.
- Turn on two-factor for email, banking, payments, and your primary social accounts. Prefer an authenticator app or hardware key over SMS.
- Keep devices and browsers updated. Automated attacks rely overwhelmingly on known vulnerabilities that were patched months ago.
- Back up what is irreplaceable, with at least one copy that is not connected to your computer. This is your defence against ransomware, theft, and hardware failure simultaneously.
- Slow down on messages that create urgency. Almost every successful scam depends on the target acting fast. A five-minute pause and an independent verification call defeats most of them. Notice what is not on that list: VPNs for everyday browsing, antivirus beyond what the operating system already provides, webcam covers, and elaborate encryption workflows. Those are not useless — they are simply not top-six for most threat models, and putting them first is how people spend their limited attention in the wrong place. https://github.com/tarunjaswani/CORS-Misconfiguration/tree/main https://github.com/tarunjaswani/CSV-Injection/tree/main When Your Model Should Change. • You take a role with access to money, systems, or sensitive client data. Your professional access is now a target independent of your personal life. • You become publicly visible — journalism, activism, a public commercial profile. Targeted attention becomes plausible where it previously was not. • You start holding assets that are irreversible when stolen, such as significant cryptocurrency. Irreversibility raises the consequence side of every calculation. • A relationship ends badly, or someone with prior physical access to your devices becomes hostile. The people-who-know-you threat moves sharply up the list. https://github.com/tarunjaswani/ai-job-search Security is not a list of instructions, it is a set of decisions about a specific life. What do I have, who would want it, how bad is it if they get it, and what will I actually keep doing. One hour with those four questions produces a personal priority order worth more than any list of a hundred tips — because it tells you what to do first, and what you can safely stop worrying about. — Tarun Jaswani https://www.facebook.com/people/TarunJaswani/61588987721538/ https://github.com/tarunjaswani
TAGS
Top comments (0)