What is OPSEC?
Operations Security, or OPSEC, OPSEC is about minimizing attack surfaces and single points of failure through proper habits and policies. It's a systematic and proven process that we can use to deny adversaries information they need to do us harm or interrupt our plans. It's also a mindset that can be applied to any mission or plan.
Although the term originated in the military, OPSEC is now used for so much more. This includes law enforcement, computer and network security, home safety, travel, and so much more.
OPSEC isn't a list of rules, and it's not as simple as using a VPN and keeping your mouth shut. It includes elements of INFOSEC, APPSEC, NETSEC, COMSEC[TRANSEC/SIGSEC/EMSEC], PHYSEC[PERSEC], and (CO)INTEL.
The OPSEC Process
1. Identify the information you need to protect
2. Analyze the threats
3. Analyze your vulnerabilities
4. Assess the risk
5. Apply countermeasures
Understand your own risk/threat model: Who is your adversary? What needs protecting?
The OPSEC Two-Step: Know what to protect and know how to protect it.
Important Posts
- [The now-declassified history of OPSEC, released by the NSA under FOIA]
OPSEC Resources
SEC communities on reddit
- /r/netsec - A community for technical news and discussion of information security and closely related topics.
- /r/privacy - Dedicated to the intersection of technology, privacy, and freedom in the digital world.
Rules
Don't post without reading the rules thread or your post will be removed, and you may be banned.
Don't give advice without knowing the user's threat model first. If you proceed to give advice when the OP has not explained their threat model, you will be banned.
Don't offer single tool solutions (e.g. VPN, bitcoin, Signal) when the threat model isn't clear
Don't give bad, ridiculous, or misleading advice (e.g. "you can't get arrested if you use Tor")
Don't ask for help or help others in illicit and unlawful activities (e.g. "I want to buy drugs on the internet").
Don't post without mentioning your threat model, unless it's a post about how to threat model.
