The Personal Security Posture 2.3A.2-3

From Data Map to Threat Map

The personal data map (sidebar 2.3A.2-1) answers what is exposed. The personal security posture answers to whom and through what vectors. The data map is an inventory. The posture assessment is a defense architecture — and the gap between the two is the gap between knowing you are exposed and knowing what to do about it.

The posture assessment maps each high-consequence entry in the personal data map against three adversary classes and their characteristic attack surfaces. The output is a one-page plan: what to harden first, what to monitor, and what to accept as residual risk — connected to the recovery plan from (2.3A.1) as the fallback when defense fails.

Three Adversary Classes

Not all threats require the same response. The posture assessment distinguishes three classes — not because adversaries sort themselves neatly, but because the defense strategies differ categorically.

Opportunistic. Automated and indiscriminate — credential-stuffing bots, phishing campaigns, malware payloads, data-broker aggregation. These attacks exploit the lowest-hanging fruit: reused passwords, unpatched software, missing two-factor authentication, default permissions. The defense is structural hygiene at the credential and device level — the practices already covered in the key management and self-custody quickstart (sidebar 2.3A.1-2). If your credential hygiene is sound, opportunistic attacks fail at the perimeter.

Targeted. Directed at you specifically — a disgruntled associate, a competitive intelligence operation, a legal adversary, a stalker. These attacks study your specific data environment and exploit its specific weaknesses: known associates for social engineering, known routines for physical surveillance, known accounts for focused compromise. The defense shifts from hygiene to compartmentalization and selective disclosure: separate high-value functions from low-value ones, limit what is discoverable through public records and social platforms, and assume that anything shared with a specific person or institution may be accessible to anyone who compromises that person or institution.

Systemic. Built into the infrastructure itself — surveillance capitalism's data collection, government mass-surveillance programs, platform terms-of-service that grant broad data rights, and AI-mediated profiling that aggregates individually innocuous data points into structurally revealing composites. These threats cannot be defeated at the individual level. They can be managed through the four disciplines (minimize, separate, encrypt, selectively disclose), monitored through the data map's annual review, and bounded through the same structural awareness that makes the threat visible in the first place. The honest limit: systemic threats require systemic responses. The individual practice is damage limitation, not elimination.

The Assessment

The posture assessment is a structured pass through the personal data map's high-consequence entries. For each entry:

1. Which adversary class is most relevant? A bank account faces opportunistic and potentially targeted threats. A health record faces systemic threats (insurance, employer data-sharing) and targeted threats (legal disputes). A social media profile faces all three. The classification determines the defense strategy.

2. What is the current attack surface? List the specific vectors through which this data could be accessed: credential compromise, social engineering, institutional data-sharing, legal compulsion, device theft, network interception. The personal data map's Pass 3 (who can access it) provides the starting inventory; the posture assessment adds the how.

3. What is the least-privilege configuration? For each data relationship, ask: what is the minimum access this function requires? Revoke permissions beyond that minimum. Disable features that expose data without functional necessity. Apply the restraint principle to your own data architecture — every unnecessary permission is unnecessary attack surface.

4. What is the residual risk? After applying structural defenses, what remains? Some risk cannot be eliminated — only accepted, monitored, or transferred. Name it. Put it on the assumptions register. Set a review date.

The output is a one-page summary: high-consequence entries, primary adversary class for each, current defense status, least-privilege actions to take, and residual risks accepted. The summary feeds the recovery plan from (2.3A.1) — because the recovery plan's value depends on knowing which failures are most likely and most consequential.

What the Posture Assessment Does Not Do

The posture assessment is not a penetration test, a threat intelligence briefing, or a comprehensive security audit. It is a personal structural assessment that makes the relationship between your data environment and your adversary environment visible — so that the four disciplines (minimize, separate, encrypt, selectively disclose) can be applied with priority rather than anxiety.

The standard is the same one that governs every tool in Arc 3: operational, not theoretical. A reader who completes the posture assessment has a one-page plan they can execute. A reader who skips it is applying privacy disciplines without knowing what they are defending against — which is architecture without a threat model.