Operations Security (OpSec)

---

Operations security (OPSEC) is a process used to protect information from unauthorized access and disclosure.

• involves putting security measures in place
• Must identify what to protect and what to protect against

Operations Security Process

The US government operations security process has 5 parts:

1. Identification of critical information
2. Analysis of threats
3. Analysis of vulnerabilities
4. Assessment of risks
5. Application of countermeasures

See Threats, Vulnerabilities, Risk, and Impact.

Countermeasures are measures put in place to mitigate risk.

Laws of Operations Security

• Kurt Haase distilled the operations security process into three rules
  • a former employee of the Nevada Operations Office of the Department of Energy
  • called the laws of OPSEC
• “If you don’t know the threat, how do you know you’re secure?”
• “Security is a state of mind”
• Laws:
  1. Know the threats
  2. Know what to protect
  3. Protect the information

History

• Origins of Operations Security