

Informally, I phrase it like:
- WHAT do you want to protect? (e.g. money, personal info, business data, specific items/resources, etc.)
- WHO do you need to protect it from? (e.g. online scammers/criminals, business competitors, an enemy government, etc.)
Consultants come up with more formal approaches for their corporate clients, but the above is usually enough for your average person. Then they can start reading the technical information looking for answers to the questions: “HOW might the threat actors get to my assets?” and “HOW can I protect those assets?”



I’m not a joker, but I’d do it like: “/jk”