I've been looking for standards or guides in threat modeling. I found lot of informations for developers threat modeling when building apps, networks etc.. but I could not find relevant information from the user point of view.
I am looking for guidelines that could help more than one user.
There are few points on which I was wondering :
- Should time be included in the threat model ? Indeed one can know what he is going to do at time t but what about time t+x ? Does one have to consider starting the process again when his habits/actions change ?
- Does overestimating threats is a good practice ? How to properly evaluate a threat ?
- What would be the best approach ? Is this subjective ?
I specified 'willing to stay anonymous' so the question is not too broad and the goal clear.