Lesson 1 of 5 · 7 min
Start with a threat model
Before changing a single setting, answer five questions that decide which protections are actually worth your time.
It is tempting to open this course looking for a checklist: turn on this, install that, and be done. The Electronic Frontier Foundation’s Surveillance Self-Defense guide argues for starting somewhere else first, with a short exercise it calls ‘your security plan’. The reason is simple: nobody can protect everything against everyone, and trying to leads to either giving up or wasting effort on protections that do not match the actual risk.
Five questions, not one setting
EFF frames security planning as a series of questions to answer in order, rather than a single decision:
- What do I want to protect? EFF calls this an asset: ‘something you value and want to protect. In the context of digital security, an asset is usually some kind of information.’ Your source’s identity, a client’s case file, your location history, your contact list, are all assets.
- Who do I want to protect it from? EFF defines an adversary as ‘a person or entity that poses a threat to your assets.’ A curious relative, a former partner, a criminal, and a state intelligence service are different adversaries, and defending against one does not automatically defend against another.
- How bad are the consequences if I fail? Losing a photo is not the same as a source’s name reaching the wrong person. Weigh the actual harm, not just the possibility.
- How likely is it that I will need to protect it? Possible is not the same as likely. A plan built around the least probable scenario often ignores the more probable one.
- How much trouble am I willing to go through to prevent those consequences? EFF is direct that ‘there is no perfect option for security’, and every protection trades off against cost, time or convenience.
EFF adds a sixth consideration that is easy to skip: allies. As the guide puts it, ‘digital privacy and security is a team sport’, and a plan that only covers your own device can still be undone by someone you work with who has not made the same choices.
Why order matters
Answering these in order changes what you do next. Someone whose main asset is a client’s legal documents and whose adversary is an opposing party has a different plan from a journalist whose asset is a source’s identity and whose adversary can compel a phone company to hand over records. The remaining four lessons in this course, accounts, the device itself, the network, and backups, are the general-purpose tools; your answers here decide which of them to prioritize, and how far to take each one.
| Question | What it changes about your plan |
|---|---|
| What do I want to protect? | Names the specific information or access worth the effort |
| Who from? | Decides whether a password manager is enough, or you also need to think about legal or state-level adversaries |
| How bad if it fails? | Separates inconvenience from genuine harm |
| How likely? | Stops you over-investing in the least probable threat |
| How much trouble will I accept? | Keeps the plan usable, since an unworkable plan gets abandoned |
Key takeaways
- EFF frames security as answering: what do I want to protect, from whom, how bad if I fail, how likely, and how much trouble will I accept.
- An asset is something you value and want to protect; an adversary is anyone who poses a threat to it.
- There is no single setting that protects everything from everyone; the point of a plan is to match effort to actual risk.
- Security is a team activity: your plan can be undone by people you work with who have not made the same choices.
- Your answers here decide how far to take the accounts, device, network and backup steps covered in the rest of this course.
Check yourself
1. How does EFF define an "asset" in a security plan?
- Any device you own
- Something you value and want to protect, usually a kind of information — Right.
- A type of antivirus software
- A backup copy of your files
EFF defines an asset as something you value and want to protect, most often some kind of information.
2. Why does EFF recommend asking "how likely is it that I will need to protect it?" separately from "how bad are the consequences?"
- They are the same question asked twice for emphasis
- A possible scenario is not the same as a likely one, and conflating them leads to misplaced effort — Right.
- Likelihood does not matter in security planning
- Consequences are always more severe than likelihood suggests
Separating likelihood from severity avoids over-investing in dramatic but improbable scenarios while ignoring more probable ones.
3. What does EFF mean by calling digital security "a team sport"?
- Security tools require a paid subscription shared by a team
- Your protections can be undone by people you work with who have not taken the same precautions — Right.
- Only organizations, not individuals, need a security plan
- Security plans should always be public
A plan focused only on your own device can still fail if collaborators handle the same information less carefully.
Do it with FireAI
Put this lesson into practice on your own Mac.
- Pick the right security mode for where you are, and use the kill switch — Match FireAI’s strictness to where you are, and know where the emergency stop is.
- Rules: app, website, domain, IP or a range, forever or until you restart — Write a rule as precise as one address or as broad as an entire domain.
- Turn on threat lists, and investigate a flagged connection — Go from a red flag to a real answer in one page, without leaving FireAI.
Sources
Put it into practice on your Mac
Try every feature free for 17 days, no card needed.