Operational security (OPSEC) is the practice of identifying information that could help an adversary and protecting it by controlling what people, systems and processes reveal.
How OPSEC works
OPSEC originated in the US military during the Vietnam War: the 1966 “Purple Dragon” study showed that the enemy learned of planned operations from unclassified, predictable activity. It is usually described as a five-step process:
- identify critical information worth protecting;
- analyse threats – who wants that information;
- analyse vulnerabilities – how it could leak;
- assess the risk;
- apply countermeasures.
The key idea is that small, harmless-looking details – travel plans, job titles, photos, metadata – can be combined into sensitive knowledge, just as attackers do with open source intelligence.
Why OPSEC matters
For organisations, poor OPSEC hands attackers the material for social engineering: org charts on LinkedIn, technology stacks in job ads, internal details on social media. In 2018 the Strava fitness app’s global heat map revealed the locations and patrol routes of military bases through soldiers’ running data.
OPSEC works both ways. Criminals and state hackers also make mistakes that expose them: the Silk Road founder Ross Ulbricht was identified partly because he had once posted under his own Gmail address. Such slips in the digital footprint of attackers are often decisive for cyberattack attribution.
OPSEC best practices
- Define what information is sensitive and who may share it.
- Train staff to limit work details on social media and to verify unusual requests.
- Strip metadata from published documents and photos.
- Use separate accounts, devices and communication channels for sensitive work.
- Review public footprint regularly, as an attacker would.
