What is OPSEC? Where it started and how a person uses it

What the word means

OPSEC stands for operations security, and the pages we read also write it as operational security. The glossary of NIST, the US National Institute of Standards and Technology, gives two definitions, both taken from US government documents. The first, from CNSSI 4009, describes a process of identifying critical information and analyzing the friendly actions that an adversary’s intelligence systems could observe. The process then picks countermeasures that remove the risk or bring it down to an acceptable level. The second, from ICS 700-1, calls it a “systematic and proven” process that denies potential adversaries information about capabilities and intentions, by identifying, controlling and protecting generally unclassified evidence of the planning and execution of sensitive activities. It adds that the process has five steps.

The vendors and the trade press say the same thing in plainer words. Fortinet describes a process that finds seemingly innocuous actions which could reveal critical data to an attacker, and says OPSEC is both a process and a strategy that asks you to look at your operations and systems from the attacker’s point of view. TechTarget gives the reason for that habit: if an organization can extract its own information while acting as an outsider, an outside adversary can likely do the same. Proofpoint, another security vendor, calls it a risk management strategy and process, and says it combines physical security, cybersecurity and the behavior of staff.

Most of these pages are written for organizations. Fortinet and TechTarget talk about networks and customer data, Proofpoint about an organization’s operations, and NIST about sensitive activities. SANS, a security training organization, is the one page of the six that speaks to a person, and it says that for some people a better OPSEC program means stopping bad actors from identifying them online or finding out where they live and work. Wikipedia adds that the private sector has also adopted OPSEC as a defense against competitive intelligence collection. This page follows the shared definition and then uses SANS to bring it down to one person.

Where it comes from

Wikipedia says the term “operations security” was coined by the US armed forces during the Vietnam War. In 1966, it says, Admiral Ulysses Sharp set up a multidisciplinary team to investigate the failure of certain combat operations. The effort was called Operation Purple Dragon and included staff from the National Security Agency and the Department of Defense. When it ended, the team wrote down its recommendations and called the process “Operations Security” to set it apart from existing processes and keep inter-agency support going.

Fortinet tells the same story with a different emphasis. In its account, the Purple Dragon counterintelligence team noticed that the adversary could anticipate US strategies and tactics without breaking any communications and without agents stealing data. The team concluded that US forces were the ones revealing the information. Fortinet adds that the team coined the first OPSEC definition, about keeping knowledge of the country’s strengths and weaknesses away from hostile forces. TechTarget describes the same team as formed to find out how the enemy obtained information on military operations before they happened. The accounts fit together: Wikipedia stresses the name, Fortinet the definition, TechTarget the purpose.

From a wartime team to a federal program

After Vietnam the idea moved into government policy. Wikipedia says that in 1988 President Ronald Reagan signed National Security Decision Directive 298, which set up the National Operations Security Program, named the director of the National Security Agency as executive agent and created the Interagency OPSEC Support Staff. TechTarget dates the same directive to January 1988 and says it required all federal departments and agencies to adopt the OPSEC approach; Wikipedia gives only the year. In April 1990, TechTarget says, that support staff published a monograph describing OPSEC as a five-step process. In January 2021 a presidential memorandum, NSPM-28, dedicated new resources to the program and created the National Operations Security Program office inside the National Counterintelligence and Security Center, which sits under the Office of the Director of National Intelligence.

TechTarget also gives the CDSE course for US defense personnel and contractors, that it describes as OPSEC awareness training, which it says ends with a certificate of completion. We did not check that course at its own site, because the CDSE page loaded as an empty shell when we tried.

The five steps, and what they ask of one person

TechTarget, Fortinet, Proofpoint, SANS and NIST all count five steps, in the same order: identify the critical information, analyze the threats, analyze the vulnerabilities, assess the risks and apply countermeasures. Only the wording changes from page to page, and the table shows how TechTarget, writing for an organization, and SANS, writing for a person, phrase each step.

The detail sits in steps two, four and five. Fortinet lists the threats as third parties that want the data, competitors, and insiders such as disgruntled or careless employees. For the fourth step Fortinet ranks the vulnerabilities by how likely attackers are to go for them, how much damage follows and how much time and work the repair takes, while TechTarget names likelihood and damage. TechTarget says to start the countermeasures with the risks that are the biggest threat. Fortinet also gives what it calls the first law of OPSEC: if you do not know the threat, how do you know what to protect?

The same steps for one ordinary person

SANS suggests some questions you can ask yourself to identify your current threat model, and the page gives three: what information do you want to protect, what can an adversary gain from looking at your online footprint and who would want it, and where do you expose yourself too much. For the first, it lists a house address, a work location, family members and assets. For the second, it names people you do not know who are looking for a soft target, and a recruiter who looks you up on social media to get an idea of your character. For the third, it points at the privacy settings on your social media and at what you post.

The example below is ours, built from SANS’s own pieces. It is an illustration and not a case from any source. Take someone who posts holiday photos. The critical information is where they live and the days the home is empty. SANS gives that very scenario: a threat actor could use shared information to break into a home during a vacation, if photos showed the family was away. The threat is a stranger looking for a soft target. The vulnerabilities are the photos that show the trip, a public profile and an old profile left online with old photos, which SANS lists as an example of poor OPSEC. For the risk, the person weighs how likely each one is to be used and how much damage it would do, the two factors TechTarget and Fortinet name. For the countermeasure, SANS’s list includes adjusting privacy settings on social media platforms. SANS also says the general rule is that people make mistakes, and the goal is to reduce their impact.

How it goes wrong

SANS opens its example of an OPSEC failure with Ross Ulbricht, whom it names as the founder and administrator of the Silk Road marketplace. In 2011, it says, Ulbricht posted in a forum looking for an IT professional in the bitcoin community and asked candidates to write to a Gmail address. SANS calls that one of several operational security mistakes that led to the arrest. The pages we read do not say how much that single post weighed against the others.

The everyday version is smaller. For people who are not doing investigative work, SANS names the general oversharing of personal information online, and leaving unused social media profiles online, especially ones with old photos. It also says OPSEC is a continuing process that needs evaluation and adaptation, and that moving into a new job may mean reassessing your threat model. It adds that OPSEC is not a one-time activity but a mindset and a set of practices.

For organizations the lists are longer, and they come from TechTarget, Fortinet and Proofpoint. They include a change management process, limiting which devices can reach the network, giving each user the minimum access needed, and dual control, which means the people who maintain the network are not the people who set the security policy. TechTarget says people are typically the weakest links and offers automation as a remedy; Fortinet says the plan must be simple to understand, straightforward to follow and updated as threats change. Proofpoint cites a 2015 case at Xoom, a money transfer company, where it says more than 30 million dollars was lost to fraudulent transfers, and presents it as a case for better operational security. That link is Proofpoint’s judgement, and we report it as such.

The habits SANS lists for everyone

SANS gives a short list of basics, which we have grouped. The page is a blog post dated 6 July 2023, so it is not a standard, and the list is SANS’s own.

• Accounts. Strong and unique passwords, not built on the name of a pet, a child or a spouse; a password manager or a password notebook; two-factor authentication on email and social accounts. Our pages on two-factor and two-step and on codes by text message cover that subject.
• Devices. The latest software and app updates, a screen lock when idle, never leaving a device unattended, and webcam covers and privacy filters.
• What you put online. Privacy settings adjusted on social media, the permissions an app asks for checked before downloading, and, in the post’s introduction rather than its list of basics, the advice to review your digital footprint, including the pictures you post that may show where you are. Our page on the digital footprint is the larger picture, and the one on metadata in photos covers the file itself.
• Services. Encrypted email such as Proton Mail, encrypted cloud storage such as Proton Drive, a search engine such as search.brave.com or startpage.com, and a VPN on public Wi-Fi at coffee shops, hotels or airports.
• People. Teaching family and friends about online privacy and security, which SANS lists as the last item.

SANS has a second list for OSINT investigators, who run open-source intelligence investigations. It includes separate accounts and devices, a paid VPN, a virtual machine, research hours matched to the time zone of the target, and written procedures. We leave that list aside, since it is written for investigations.

Where Tor and a VPN fit

The pages we read do not mention Tor, Tor Browser or anonymity. They mention a VPN in two places, both in SANS: on public Wi-Fi, and, for investigators, as a way to mask an IP address. Anything beyond that comes from the rest of this site and not from these sources. One more point from the sources helps place a VPN: SANS puts it in two different jobs, a basic habit on public Wi-Fi for everyone and, for investigators, a paid VPN to mask an IP address, so the same tool answers two different threats.

What the five-step frame gives us is a way to place them. A tool is something you pick at the fifth step, after you know what you are protecting, from whom, and where you are exposed. That is our reading of the frame, not a statement from the sources. The pages we have on the tools are Is Tor Browser safe?, Tor bridges, the VPN page and private browsers and fingerprinting.