Good OPSEC does not begin with Tor, a VPN or a new laptop. It begins with a question: what are you protecting, from whom, and for how long? Without that answer it is easy to assemble an expensive collection of tools that does not address the actual risk.
1. Name the assets and threats
Write down what must remain protected: an account, a device, documents, a location, relationships between people, or continuity of work. Then name a realistic adversary. Losing a phone, facing an account-takeover scam, and defending against an organisation able to correlate multiple data sources require different controls.
Replace “I want to be anonymous” with statements you can test:
- private correspondence must not appear on a work computer,
- loss of a phone must not open mail and banking,
- a public pseudonym must not automatically connect to a private email address,
- loss of one account must not block recovery of every other account.
2. Separate identities and roles
The most common failure is linking supposedly separate tools through a shared detail. A recovery address, phone number, username, photograph, writing pattern or schedule may connect profiles.
Separation should cover accounts, browser profiles or systems, file metadata, payment channels when relevant, and recovery methods. Not every role needs a dedicated device, but every role needs a clear boundary and a plan for mistakes.
3. Secure the device before complicating the network
An updated system, full-disk encryption, a screen lock, recoverable accounts and tested backups matter more than a sophisticated route on a neglected endpoint.
The baseline is:
- automatic operating-system and browser updates,
- full-disk encryption,
- unique passwords and phishing-resistant MFA where available,
- recovery codes stored away from the primary device,
- a backup that can actually be restored,
- removal of unnecessary applications and extensions.
4. Match the network path to the threat model
A VPN changes who sees the internet exit; it does not remove accounts, application telemetry or browser fingerprints. Tor limits what a single part of the route knows, but it does not fix signing into a personal account or sharing a document with identifying metadata.
When isolation is required, consider separate profiles, virtual machines or an operating system designed to separate roles. The article about Tor, Whonix and Qubes OS explains these layers without promising invisibility.
5. Plan for failure
OPSEC that is too difficult to maintain ends in shortcuts under pressure. Record what happens after device loss, which independent channel confirms urgent requests, where recovery codes are kept, which sessions must be revoked, and how affected people are informed.
Review the procedure regularly. A secure environment is not a state reached once; it is a set of boundaries that can be tested and improved.
If you need a review of a real environment, define a security assessment instead of buying another tool without a threat model.