What could go wrong?

A defender's most powerful habit is asking, before any attack happens: what could go wrong, and who might try? This is called threat modelling, and you need no tools to start.

A simple version asks four questions:

1. What am I protecting? (the asset)
2. Who might attack it? (the threat)
3. How could they get in? (the weakness)
4. What will I do about it? (the defence)

Example: protecting a school's student records. Threat: a curious student, or an outsider. Weakness: a shared, weak password. Defence: strong unique passwords and limited access.

Thinking this way turns vague worry into a clear list of things to fix.

Practice

Pick one system you use (email, a social account, mobile money). Answer the four questions for it. Your answer to question 4 is your to-do list.