Security training: Organizers and Journalists versus Assholes with Resources

Wiki ▸ Security culture ▸ Persona-based training matrix ▸ Security training: Organizers and Journalists versus Assholes with Resources

How to use this persona-based threat modeling matrix:

1. You are a "defender" (a given row). Find yourself there.
2. Your concern(s) map to a given "attacker" (a given column). Find your attacker.
3. Find the cell at which these two personas intersect. Everything listed in the cells above and to the left of your cell applies to you, too.
4. Start at the top-left cell and read the advice from left-to-right, top-to-bottom, until you reach your cell. Then stop worrying. :)

		Attackers
		Random Assholes	Assholes with Resources	The State
Defenders	Individuals	Individuals vs Random Assholes	Individuals vs Assholes with Resources	Individuals vs The State
	Organizers and Journalists	Organizers & Journalists vs Random Assholes	Organizers & Journalists vs Assholes with Resources	Organizers & Journalists vs The State
	Targeted Activists	Targeted Activists vs Random Assholes	Targeted Activists vs Assholes with Resources	Targeted Activists vs The State

Organizers and Journalists versus Assholes with Resources

Prerequisites

Before you dive too deeply into this practice material, you should first explore the following lower-hanging fruit in the following order:

1. Security training: Individuals versus Random Assholes
2. Security training: Individuals versus Assholes with Resources
3. Security training: Organizers and Journalists versus Random Assholes

Practices

• Audit your webserver for information disclosure vulns (a thorough treatment of webdev security things):
  • Turn off "directory listings" on your webserver
  • WordPress users should follow these guidelines
• Use alternatives to Google Docs such as pad.RiseUp.net or share.RiseUp.net, etc.
• Prevent spoofing of emails claiming to be from your domain by implementing DKIM for email services you provide
  • Use the ValiMail Domain Checker to check that your domain is correctly configured to be able to accept and relay validated/authenticated email.
  • Use DKIM Verifier for Thunderbird to test your (or anyone else's) DKIM setup in your email client.
• On your server(s), use LetsEncrypt to enable TLS connections (for Web+Mail+any hosted service)
  • Specify a CAA (Certificate Authority Authorization) DNS record for your domain to assert only your CA of choice (like Let's Encrypt) should issue certificates for your domain.
• Use Tor to hide your physical-world location
• Consider placing your own domain behind CloudFlare to hide your server's origin
• Replace Facebook (or other similar) group chats with secure messenger (e.g., Signal) group chats
• Turn off all logging by the services you run you don't regularly look at. (Configure per-service or using logrotate(8) rotate 0 and shred configuration options.)
• Test RSA keys you've generated against the ROCA vulnerability and re-key if necessary.
• Use a hardware second factor (an "authentication dongle") on sites that support hardware-enforced second factor authentication support.
• Whitelist external USB, Thunderbolt, etc. devices with tools such as USBGuard.
• If you run an Intel motherboard, change the default Intel AMT BIOS password from its default of admin.