Building Your x230 Threat Model

Hello! Welcome back to our course on building a secure ThinkPad.

Introduction

In our last lesson, we established the theoretical foundation of security engineering by defining threat modeling and the concept of the 'adversary'. We explored how a system's security is only meaningful in relation to the specific threats it is designed to withstand, using the Popperian idea of falsifying security claims rather than trying to prove them.

Today, we will put that theory into practice. Your goal for this lesson is to formulate a personal threat model for your x230 project. This involves a structured process of identifying what you want to protect, who you need to protect it from, and how they might attack. This process of risk assessment—weighing assets, threats, likelihood, and impact—will be very familiar to you from your background in economics and finance. The threat model we create today will serve as our guiding document for every technical decision we make throughout this course.

This lesson should take approximately 60 minutes.

1. A Framework for Personal Threat Modeling

To move from abstract theory to a concrete plan, we need a structured framework. A simple and effective method for personal threat modeling is to answer a series of five critical questions. This approach forces clarity and helps prioritize your efforts where they matter most.

Reading (10 mins):
Please read the following sections from the Privacy Guides article on threat modeling. This will introduce the five-question framework that we will use to build your model. Focus on understanding the purpose of each question.

Threat Modeling: The First Step on Your Privacy Journey (Threat Modeling: Introduction; Creating Your Threat Model; What do I want to protect?; Who do I want to protect it from?; How likely is it that I will need to protect it?; How bad are the consequences if I fail?; How much trouble am I willing to go through?)

To recap, the five questions are:

1. What do I want to protect? (Your assets)
2. Who do I want to protect it from? (Your adversaries)
3. How likely is it that I will need to protect it? (Risk/Probability)
4. How bad are the consequences if I fail? (Impact)
5. How much trouble am I willing to go through? (Your security/convenience trade-off)

Answering these questions systematically transforms a vague desire for "security" into a specific set of actionable requirements.

2. Identifying Adversaries and Goals

The most crucial part of this exercise is identifying your potential adversaries. As we discussed, a defense against a "casual thief" looks very different from a defense against a "targeted attacker."

A helpful way to structure your thinking about adversaries is to consider broad categories and your desired level of protection against each.

Video (8 mins):
Please watch this segment from Techlore's video on threat modeling. It introduces a practical 3x3 chart (People, Companies, Governments vs. Security, Privacy, Anonymity) and walks through an example. This will help you brainstorm and categorize your own potential adversaries.

1. Highlight 1: 0:00 - 0:00
2. Highlight 2: 0:00 - 0:00

As the video suggests, your adversaries exist on a spectrum. For our x230 project, we can simplify this into a few key archetypes:

• The Opportunist (e.g., casual thief, public Wi-Fi snooper):

  • Goals: Steal the physical hardware for resale; capture unencrypted data or credentials for financial gain.
  • Capabilities: Low technical skill. Relies on physical access (theft) or insecure network conditions. Not specifically targeting you.

• The Targeted Attacker (e.g., business competitor, determined criminal):

  • Goals: Steal specific intellectual property, financial data, or personal information from you.
  • Capabilities: Moderate to high technical skill. May attempt to exploit software vulnerabilities or use sophisticated phishing attacks.

• The "Evil Maid" / Advanced Attacker (e.g., corporate or state-level actor):

  • Goals: Full compromise of the device for persistent surveillance, data exfiltration, or to de-anonymize you.
  • Capabilities: High skill and resources. Has temporary, repeated, or surreptitious physical access to the device (e.g., in a hotel room). Capable of hardware or firmware-level attacks.

Your task is to decide which of these (or other adversaries you define) are relevant to your situation and goals for this project.

3. Deconstructing Attacks with Attack Trees

Once you have an adversary and their high-level goal (e.g., "read my files"), how do you analyze their capabilities? A powerful method for this is the attack tree.

An attack tree is a hierarchical diagram that deconstructs an adversary's goal into the concrete steps required to achieve it. This is a concept you might appreciate given your background in structured problem-solving and systems like MARL. The root of the tree is the main goal, and the leaves are the specific, actionable attack vectors.

Video (5 mins):
Watch this segment explaining the concept of attack trees. It shows how a primary goal (e.g., "access email server") can be broken down into sub-goals and specific methods. You don't need to create a complex diagram yourself, but focus on understanding the logic of working backward from a goal to identify necessary capabilities.

For example, consider the "Evil Maid" adversary whose goal is to "Install a keylogger." An attack tree might look like this:

• Goal: Install a keylogger on the x230.
  • Sub-goal: Gain privileged access to the OS.
    • Method 1: Boot from a malicious USB drive.
      • Prerequisite: BIOS/UEFI allows booting from external devices.
      • Prerequisite: Full Disk Encryption is not active or can be bypassed.
    • Method 2: Exploit a vulnerability in the bootloader.
      • Prerequisite: The bootloader is not cryptographically signed or verified.
  • Sub-goal: Persist the keylogger across reboots.
    • Method 1: Modify the BIOS/UEFI firmware.
      • Prerequisite: The BIOS chip is writable.
      • Prerequisite: No secure boot mechanism is in place to verify firmware integrity.

This structured thinking allows us to pinpoint the exact security controls needed to thwart an adversary. To prevent Method 1, we need Full Disk Encryption and to configure the firmware to prevent unauthorized USB booting. To prevent Method 2, we need to replace the vulnerable proprietary firmware with something more secure, like Coreboot with a verified payload—which is exactly what we will be doing later in this course.

4. Activity: Formulate Your Personal Threat Model

Now it's your turn to apply these concepts. Take the next 20-25 minutes to draft your personal threat model for the x230 project. Be specific and realistic. This is the foundational document for the rest of our work.

Create a document and structure it using the template below.

My x230 Threat Model

1. What do I want to protect? (Assets)
(List at least 3-5 key assets. Be specific. Examples: The physical laptop itself, private keys for cryptocurrency, source code for my startup, my anonymity when researching sensitive topics, communications with investors, etc.)

• Asset 1: ...
• Asset 2: ...
• Asset 3: ...
• ...

2. Who do I want to protect it from? (Adversaries & Scenarios)
(Define 2-3 distinct adversaries. For each one, describe their goals, capabilities, and the likely scenario of an attack.)

Adversary 1: The Opportunist (e.g., Casual Thief)

• Goals:
• Capabilities/Access:
• Scenario:

Adversary 2: The Targeted Remote Attacker

• Goals:
• Capabilities/Access:
• Scenario:

Adversary 3: The "Evil Maid" (Advanced Physical Attacker)

• Goals:
• Capabilities/Access:
• Scenario:

3. Risk Assessment & Mitigation Priorities
(For each adversary, briefly assess the risk and state the primary mitigation strategy you think is necessary. This links your model to our future actions.)

• Against Adversary 1:
  • Risk (Likelihood/Impact):
  • Primary Mitigation: (e.g., "Full Disk Encryption to make stolen data unreadable.")
• Against Adversary 2:
  • Risk (Likelihood/Impact):
  • Primary Mitigation: (e.g., "Using a hardened OS with compartmentalization to limit the impact of malware.")
• Against Adversary 3:
  • Risk (Likelihood/Impact):
  • Primary Mitigation: (e.g., "Replacing proprietary firmware with Coreboot to prevent persistent hardware implants.")

Conclusion

Excellent work. You have now translated abstract security principles into a concrete, personalized plan. This document is not static; like any good strategy, it should be revisited and revised as your circumstances or concerns change. However, it now provides the critical "why" for all the technical steps that will follow.

Key Takeaways:

• A personal threat model is created by systematically identifying your assets, adversaries, and the risks they pose.
• Adversaries can be categorized by their goals, capabilities, and level of access (e.g., Opportunist, Targeted, "Evil Maid").
• Structured methods like attack trees help deconstruct an adversary's goals into specific steps, revealing the exact points where security controls are needed.
• Your threat model is the strategic document that justifies the tactical decisions we will make, from firmware flashing to OS configuration.

Preview of the Next Lesson:

In our next lesson, we will begin Module 2: "Firmware Security." We will dive into the role of the BIOS/UEFI and discuss the security risks of proprietary firmware, particularly the Intel Management Engine (ME). Your threat model—especially your defense against an "Evil Maid" or other advanced attacker—directly motivates why we must address security at this fundamental hardware level. You've identified the threat; next, we'll start building the defense.