James Mickens gave a lecture at a conference (I think it's this one: https://www.youtube.com/watch?v=tF24WHumvIc https://www.youtube.com/watch?v=tF24WHumvIc but

James Mickens gave a lecture at a conference (I think it's this one: https://www.youtube.com/watch?v=tF24WHumvIc https://www.youtube.com/watch?v=tF24WHumvIc but I don't have time to actually listen through it) about how there are two different threat models for computer security: bored five year olds and the Mossad. And bored five year olds just try the same three things again and again, and as long as you take basic precautions you can protect yourself against them. You cannot protect yourself against the Mossad, don't even try. When I first started paying attention to computer security I was at a start-up and tasked to rewrite their PCI infrastructure for credit card processing, so I did some research into the state of the art. That week news of a casino hack came out. Billionaire casino/media magnate and conservative donor Sheldon Adelson gave a speech in October 2013 about how the US should threaten to use nuclear weapons to destroy Iran's nuclear program. In February 2014 a 150 line VB virus was installed on his casino's network which wiped all of the hard drives it could find, costing the Sands hundreds of millions of dollars. This was at a casino, some place which absolutely cares about their computer security and presumably spends a lot on that security, and they failed to successfully protect themselves against a nation-state level threat. So whatever the hell startup I was working at had no chance if someone at that level wanted it. We could stop the five year olds. Just not the nation-states.