We all know that in the security field everything depends on the threat model, which basically means you need to define who or what you are protecting from. But who should decide this, and on what objective basis? Since you can't protect everything from everything, you need to choose the most likely threats and focus on those. But I think it's difficult to assess the likelihood of a threat without making subjective decisions, and I don't know if there is a method or collection of best practices that can help.
I'm asking this question because I realized I can't decide what to protect from. It's easy to say "don't open attachments from suspicious senders", but who decides who's suspicious, and how exactly? It could be defined as "anyone not in your contact list", or "anyone as long as they aren't from [insert your favorite rogue country here]", but that seems very subjective to me. If I don't trust my browser I might use it inside a VM, if I don't trust the VM I might use it in an air-gapped machine, if I don't trust the machine... well, it never ends, so again, who decides what I should trust and on what basis? Or for example, how do I know if I should even protect from the government, if I'm likely a target? It might look like there's only a thin line between a threat model and paranoia, but at least real paranoia can be diagnosed. The doctor checks some symptoms in an official book, and makes decisions based on that (or at least he should). By analogy, if there was an objective method to define threat models, the doctor would open his book and be like, "Yes, China is officially considered a rogue country as far as infosec is concerned, so in this case you should definitely reject email coming from there", or "No, in your situation you should just trust the software in your distro's official repo; if you don't trust it then you might be paranoid and might have to take these pills".