Understanding OPSEC: A Process for Protecting Sensitive Information, Study Guides, Projects, Research of Learning processes

Download Understanding OPSEC: A Process for Protecting Sensitive Information and more Study Guides, Projects, Research Learning processes in PDF only on Docsity!

What is?

An overview for the Executive

The OPSEC Process

In a nutshell, OPSEC is a process that teaches you:

• to examine your day-to-day activities from an adversary’s point of view
• to understand what an adversary can learn about your organization from these activities (observable and collectables)
• to assess the amount of risk this places on the organization
• to develop and apply countermeasures (fixes) so that bad people don’t obtain our information

The 5 Step OPSEC Process

Step 1 – Identify Critical Information

Step 2 – Analyze the Threat

Step 3 – Analyze the Vulnerabilities

Step 4 – Assess the Risks

Step 5 – Apply Countermeasures

The 5 Step OPSEC Process

Step 1 - Identify the Critical Program

Information

• Best defined by the people actually working on the project, program, or activity
• Adversary determines critical program information by looking for indicators
• Indicators are things that can be heard, observed, imaged, or collected

The 5 Step OPSEC Process

Step 2 - Analyze the Threat

• Identify adversaries, their goals, capabilities, and intentions
• Threat analysis is based on identification of above information
• Needs and capabilities of adversary are consistently evaluated against critical program information being protected Threat is the capability of an adversary, coupled with intentions, to undertake any actions detrimental to the success of your program, project, or activity

The 5 Step OPSEC Process

Step 3 - Analyze Vulnerabilities

• Look from perspective of your adversaries
• Look at it from the perspective of each adversary
• Accomplished through the OPSEC assessment process
• Examine program, project, or activity from beginning to end

The 5 Step OPSEC Process

Step 5 - Apply Countermeasures

• Actions that deny or reduce the availability of information to the adversary
• Most are simple procedural adjustments that eliminate or minimize indicators
• Generic countermeasures may be -- better control of information (awareness) -- increased traditional security (may create an indicator) -- changes in procedures

Conclusions

OPSEC is a process that denies, delays, or disrupts an adversary’s capabilities to determine our classified and sensitive programs, projects, and activities. OPSEC is a low-cost countermeasures program OPSEC is risk management process for protection of Department of Energy’s and National Nuclear Security Administration’s information security program