Operational Security (OPSEC) Basics

Operational Security (OPSEC) is the process of protecting sensitive information from adversaries by identifying critical information, analyzing threats, and implementing countermeasures. Originally a military concept, it's now essential for security professionals, journalists, and activists.

The formal OPSEC process:

1. Identify critical information — what must be protected?
2. Analyze threats — who wants this information?
3. Analyze vulnerabilities — how could it be exposed?
4. Assess risk — what's the probability and impact?
5. Apply countermeasures — reduce risk to acceptable level

Individual pieces of seemingly harmless information can be combined to reveal sensitive details. Posting your coffee shop, your work schedule, your neighborhood, and your car model separately creates a target profile. Adversaries aggregate open-source data into actionable intelligence.

Reducing your digital footprint:

• Use aliases and separate email addresses for different purposes
• Minimize public social media exposure
• Use privacy-preserving search engines (DuckDuckGo, Brave)
• Opt out of data broker sites
• Review app permissions regularly

Compartmentalization separates identities, tools, and activities to limit cross-contamination. A security researcher might use separate devices, browsers, and email accounts for different personas or client engagements.

Choosing secure communication channels:

• Signal — end-to-end encrypted messaging with disappearing messages
• ProtonMail — encrypted email
• Avoid email for sensitive discussions when possible
• Know that metadata (who you talk to, when) is often as revealing as content

Physical OPSEC measures:

• Screen privacy filters on laptops in public
• Disable microphone/camera when not in use
• Be aware of shoulder surfing in public spaces
• Use disk encryption (BitLocker, FileVault, LUKS)
• Shred sensitive documents

Notable OPSEC failures:

• Sabu (LulzSec): forgot to use Tor once → IP revealed → arrested
• Ross Ulbricht (Silk Road): used same username across multiple sites years before creating Silk Road
• APT groups: reusing malware code or infrastructure tied to previous operations

During engagements, pentesters practice OPSEC to simulate real adversaries and avoid accidentally exposing client systems to real attackers:

• Use VPNs or anonymizing infrastructure
• Rotate tool signatures
• Clean up artifacts after testing
• Document all actions for reporting

Your OPSEC posture depends on your threat model:

• Average person: basic password hygiene + MFA
• Security professional: compartmentalization + strong encryption
• Journalist/activist: full Tor usage + air-gapped devices for sensitive work

Excessive OPSEC without a matching threat model is counterproductive friction.

Effective OPSEC is not a checklist but a mindset: continuously asking "what information am I revealing, to whom, and what can they do with it?" This adversarial self-assessment becomes habit with practice.

An analyst uses the same username on a personal gaming forum that they used while setting up a covert operation. What OPSEC principle did they violate?

OPSEC protects sensitive information through a five-step process: identify critical information, analyze threats and vulnerabilities, assess risk, and apply countermeasures. Key practices include compartmentalization, digital footprint reduction, secure communications (Signal, ProtonMail), and physical security. OPSEC posture should match the actual threat model.