I am aware through hearsay of the threats exposed by certain digital assets. For example, not only should a password be kept secret, but it should not be re-used. Having the scenario unpacked for me, I now understand that password re-use is risky.

But I would suggest that this is somewhat unintuitive, and may not have occurred to me if I was asked Who are you protecting it from?

Given the plethora of digital assets used in domestic life (email accounts, service accounts, IoT devices, IMEI), rather than a commercial scenario, how can I reliably start threat modelling?

To be specific rather than broad, is there a foundational threat model for families/domestic users? One specific example would answer the question.

  • these might be relevant goodreads.com/book/show/…
    – user303853
    Commented Jan 26 at 20:58
  • goodreads.com/book/show/44414033-internet-of-things
    – user303853
    Commented Jan 26 at 20:58
  • The same basic principles that apply in business apply also in domestic life, use 2fa, don't click on suspicious links in emails, don't share passwords or user accounts. A domestic family is a less value target that a business so they would be less interesting for a professional threat actor or nation state threat actor.
    – Turdie
    Commented Jan 27 at 0:04

1 Answer 1

  1. There are different security levels for WiFi. There’s the lowest level which allows hacking into your WiFi if I have the password. Important if you give the password to a family member who needs it but who is careless and passes it on to others.

  2. Again for WiFi, iOS allows your Mac or iPhone to hand your WiFi password to a phone belonging to someone in your address book. The owner of the phone will not be able to access the password, only the phone can do it to log in to your WiFi. (I tried once because I forgot the bloody WiFi password. No way to get it. Had to reset it manually, and enter it manually on my tv, tv recorder, and Apple TV. 20 characters that I needed to enter blind with zero mistakes).

  3. In general, you can use a not-very-secure password for things that are not risky at all. That takes careful consideration. It must be only for things where I can’t do any damage to you if I can log into all accounts with that password.

  • This answer doesn't really seem to touch on threat modeling but seems to focus a lot on WiFi. Commented Feb 19 at 16:12

You must log in to answer this question.