If you’ve been in the security world long enough, you’ve heard of a term called “OPSEC” or operational security. This is a security discipline in which organizations or individual operators conduct their business in a manner that does not jeopardize their true mission. If you’re a police officer who is staking out a house, it would be bad OPSEC to sit outside the house in a marked police vehicle. I think it’s prudent we discuss this discipline so we can better analyze our own processes by which we protect ourselves and our operations. Reviewing the OPSEC process is a great place to start. The following come from Wikipedia (I know – it’s super-scholarly):
Identification of Critical Information: Identifying information needed by an adversary, which focuses the remainder of the OPSEC process on protecting vital information, rather than attempting to protect all classified or sensitive unclassified information.Analysis of Threats: the research and analysis of intelligence, counterintelligence, and open source information to identify likely adversaries to a planned operation.Analysis of Vulnerabilities: examining each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then comparing those indicators with the adversary’s intelligence collection capabilities identified in the previous action.Assessment of Risk: First, planners analyze the vulnerabilities identified in the previous action and identify possible OPSEC measures for each vulnerability. Second, specific OPSEC measures are selected for execution based upon a risk assessment done by the commander and staff.Application of Appropriate OPSEC Measures: The command implements the OPSEC measures selected in the assessment of risk action or, in the case of planned future operations and activities, includes the measures in specific OPSEC plans.Assessment of Insider Knowledge: Assessing and ensuring employees, contractors, and key personnel having access to critical or sensitive information practice and maintain proper OPSEC measures by organizational security elements; whether by open assessment or covert assessment in order to evaluate the information being processed and/or handled on all levels of operatability (employees/mid-level/senior management) and prevent unintended/intentional disclosure.We should also recognize good guys aren’t the only ones who practice this discipline. As a matter of fact, the bad guys do as well and many are quite good at it. The lessons we could learn from them, our fellow security professionals, and others are almost immeasurable.
NEVER trust a big butt and a smile. Yup. I started off with that. Bear with me. Many intelligence agencies and law enforcement organizations use sex as a means to get close to a target or person of interest. Most bad guys realize this. However, many do not to their own detriment. When involved with people in a relationship or sexual encounter, they get very close to you and your secrets. I liken these people to “trusted agents” who you allow close enough to you that can get more information than you’re willing or able to share publicly. Poor OPSEC practitioners often forget this. Most of their security failures stem from this fatal flaw. I’m not saying to not be in a relationship or to eschew intimacy. If you’re in a job that requires you adhere to sound OPSEC principles, what I’m advising you to do is to exercise due diligence and conduct a risk analysis before you do. Think Marion Barry, Anthony Weiner, and Elliott Spitzer.Immortal words spoken during an EPIC fail.Always have a thoroughly vetted back-story for your cover. This is commonly referred to as “legend” in the intelligence community. This is an identity in line with your established, synthetic cover. For example, I previously mentioned the hacker known as the The Jester in a previous blog post. Depending on which side you’re on, he’s either a bad guy or a good guy. However, the lessons he teaches us about cover are insightful. Whenever someone “doxes” him, he has a prepared and detailed analysis as to how he created that cover identity. Many times he’ll use a name that does exist with a person who either does not exist or who he has cleverly manufactured using a multitude of identity generators. He’ll use disposable credit cards, email, LinkedIn profiles, VPNs which show logins from his cover location, etc. He even engages in cyber-deception with other actors to establish various cover stories for operations that require them. Whether you like him or not, he’s certainly good at one thing we know for sure – cover discipline.NEVER trust anyone you just met. I see you laughing. Many people mistakenly believe they can and should trust everyone they meet. They will often claim they don’t but their behavior says otherwise. As Ronald Reagan is often quoted is saying, “In God we trust, all others we verify” I firmly believe this to be the most crucial aspect of operational security. Proper trust is needed in any environment for the mission to be accomplished. However, blind trust can and will kill any hopes of a successful mission. Whether you’re checking identification at an entry control point or planning cybersecurity for an online bank, you should always treat every introduction you don’t initiate as suspect. Then triage people and their level of access according to risk acceptance. This is a lesson we learned with Edward Snowden. He’d only been at Booze Hamilton a few months before he began siphoning massive amounts of classified information he had no direct access or need-to-know. Another saying I’m fond of is “Keep your enemies close, but your friends closer.” I’m not saying everyone you meet is going to steal from you or betray your trust. Like my momma always says, “Not everyone that smiles at you is your friend and not every frown comes from an enemy.”Shut the hell up! No. Seriously. Shut up. If you hang around the special operations community, you’ll hear a term used to describe the work they do as “quiet professionals”. Most successful bad guys realize the best way to ensure longevity to shut the hell up. Bragging about or giving “pre-game commentary” before an operation are guaranteed ways to get caught or killed. The truly dangerous people are the one’s who never say a word and just do their work. Sometimes, lethality is best expressed with silence.

Watch what you leak. While we can keep our mouths shut, it is more difficult in the information age to keep everything connected to us quiet. In order to properly protect ourselves, we have to begin this process by conducting proper risk analysis. Is what I’m doing right now giving away something I don’t want the public to know? Is the the device or medium I’m talking on able to give away information I’m not comfortable with sharing? Does my enemy have the ability to intercept or analyze what I’m doing in order to gain sensitive information? What “tells” am I projecting? These are a few of many questions you should be asking in order to ensure you’re limiting “noise litter”.

In the information age, do I need to say more?If you’re doing secret stuff, NEVER EVER EVER EVER EVER, talk on the wire. Look at the Mafia as a perfect example of what not to do. As an OPSEC practitioner, you should never communicate on any medium that can give away your secrets or be intercepted. John Gotti got busted talking on the wire. A person rule of thumb: If it can receive messages, it can transmit messages without you knowing. Treat every computer like an informant – feed it what you’re willing to share with your adversary.NEVER ever touch or be in the same place as the “product”. For the uninitiated, that is one of first rules of the dope game. Every successfully, elusive drug dealer knows to keep away from the “product” (read “drugs). Whatever the “product” in your “game”, ensure you put enough distance between you and it. If you have to be close to it, then have a good reason to be with it.Recognize “the lion in the tall grass”. When practicing OPSEC, if there is one thing you should never forget is why you’re doing it. The reason you’re practicing it is simple – there are people out there that oppose you. Ignore them at your detriment.NEVER say something you can’t backup or prove immediately. Nothing says you’re a person needing to be checked out better than saying things you can backup or prove. People who are trying to vet you will require you backup what you say for a reason. Be ready for this. A great example of this is demonstrated by people who claim to be connected to someone of stature in order to gain access. In this case, they’re found out because the target asked the other party who could not confirm this.Treat your real intentions and identity as that gold ring from Lord of the Rings. I’m not saying put your driver’s license on a necklace so a troll who think it’s his “precious” won’t take it. First of all, that’s too cool to happen in real life. Second, you’ll look like an idiot. Finally, there are more practical ways of protecting your identity. For starters, never have anything that connects your identity to your operation. Next, if you have to use your real identity in connection with an operation, give yourself some ability to deny the connection. Lastly, NEVER trust your identity, intentions, or operations to anyone or anything other than yourself.I’ve decided to include the more practical list from the “Notorious B.I.G.” to drive home some of these principles:
TEN CRACK COMMANDMENTSRule number uno, never let no one know
How much, dough you hold, ’cause you know
The cheddar breed jealousy ‘specially
If that man *** up, get your *** stuck upNumber two, never let ’em know your next move
Don’t you know Bad Boys move in silence or violence
Take it from your highness
I done squeezed mad clips at these cats for they bricks and chipsNumber three, never trust nobody
Your moms’ll set that *** up, properly gassed up
Hoodie to mask up, s***, for that fast buck
She be layin’ in the bushes to light that *** upNumber four, know you heard this before
Never get high on your own supplyNumber five, never sell no *** where you rest at
I don’t care if they want a ounce, tell ’em bounceNumber six, that God*** credit, dig it
You think a *** head payin’ you back, *** forget itSeven, this rule is so underrated
Keep your family and business completely separated
Money and blood don’t mix like two *** and no ***
Find yourself in serious s***Number eight, never keep no weight on you
Them cats that squeeze your *** can hold jobs tooNumber nine, shoulda been number one to me
If you ain’t gettin’ bags stay the f*** from police
If niggaz think you snitchin’ ain’t tryin’ listen
They be sittin’ in your kitchen, waitin’ to start hittin’Number ten, a strong word called consignment
Strictly for live men, not for freshmen
If you ain’t got the clientele say hell no
‘Cause they gon’ want they money rain, sleet, hail, snowDon’t forget the admonition from Notorious B.IG. gives that should never be diminished:
Follow these rules, you’ll have mad bread to break up
If not, twenty-four years, on the wake up
Slug hit your temple, watch your frame shake up
Caretaker did your makeup, when you pass
An information security professional known as “The Grugq” gave a very interesting talk on OPSEC, I think it is worth taking a glance at (try to contain all laughter and bafoonery at the preview image – we’re running a family show here, folks):