/biz/ - Business & Finance

>What does a failure in compartmentalization look like?

Here we have a couple of articles that clearly demonstrate the consequences of failure in a high threat model scenario. You will notice that these failures did not occur due to any technical issue, or as a result of some agency type... These are high profile people failing in very simple ways and more often than not, it is these simple mistakes that are the issue.
www.ivpn.net/privacy-guides/online-privacy-through-opsec-and-compartmentalization-part-2/
-
The biggest takeaway we can get from this is for gods sake, do not link your personal email, especially one that is your own damn name, to any sensitive activities, That sounds like a no-brainer, but as we just read, stupid mistakes happen even to those who should have known better.

>Where do we start?

The first step to any opsec endeavour is to assess our threat model and in this case, to get a birds eye view of all our various accounts and identities. A good place to start is by creating a list of the communities/accounts we have created, breaking them down into categories or "tiers" of Public - Sensitive - Secret. Which of these accounts are you okay with, or need to be associated to your IRL identity? Which ones do you want to be pseudo-anonymous, but used in multiple communities/activities? Which ones do you want to be kept absolutely separate from your IRL identity and from any other community/activity you partake in? By doing this we can create an overview of the topography of our online activities and which ones are already linked.
The next step is to assess our threat model. Before we can start hardening our defenses, we need to have some idea of what kind of adversary is going to be at our gates.