4.1 Operations Security (OPSEC) Flashcards
Why is it important to identify your critical information?
So you are applying the right level of opsec to critcal info.
What is the first law of OPSEC?
By Kurt Haase, “ If you don’t know the threat, how do you know what to protect?”
What is the second law of OPSEC?
If you don’t know what to protect, how do you know you are protecting it?
What is the third law of OPSEC?
By Kurt Haase, “If you are not protecting [the information]…..the dragon wins!
What is the function of the IOSS?
Training and OPSEC Awareness - Interagency OPSEC Support Staff
What part did George Washington play in the creation of operations security?
Understood that when small pieces of seemingly useless information is combined, it can become dangerous. (name, address, social sec number).
-Also understood importance of secrecy and establishing an intelligence gathering program, which he started.
In the operations security process, what is the difference between assessing threats and assessing vulnerabilities?
Vulnerabilities are the gaps in infrastructure that a threat(or malicious event) could occur.
Why might you want to use information classification?
This process helps to know what you have to protect, so you can actually protect it. Relates to the second Law and 1st step of the OPSEC cycle.
When you have cycled through the entire operations security process, are you finished?
No this is an iterative process that takes repeating.
From where did the first formal OPSEC methodology arise?
What is the origin of operations security?
-During the Vietnam War - military realized spies were relaying troop movement. A survey was conducted to determine information lost and determined vulnerability. Coined OPSEC.
-Also Sun Tzu in the Art of War provides earliest OPSEC principles.
Define competitive intelligence?
-Used in Business industry
-Gathering and analyzing intelligence to assist business decisions.
Define competitive counterintelligence?
Opposite of competitive intelligence - employing OPSEC principles
Operations security (OPSEC) is a risk management process that involves the ___________ of critical information, analysis of ___________and _________, _________assessments, and the application of _________. It aims to protect sensitive information from _________ and __________.
identification; threats and vulnerabilities; risk ; countermeasures
unauthorized access and disclosure.
Haas’s Laws of OPSEC underline the fundamental principles such as…(2 statements.
“If you don’t know the threat, how do you know you’re secure?” and “Security is a state of mind.”
-Finding potential threats and vulnerabilities is called?
-Assessing the level and impact of risks is called?
-Applying countermeasures to reduce risks is called?
- Risk Identification:
- Risk Analysis:
- Risk Mitigation:
Identify the Layers of a Defense-in-Depth Strategy (3x)
Physical Controls: Access controls, surveillance cameras.
Logical Controls: Firewalls, encryption.
Administrative Controls: Policies, employee training.
Compare Abilities of Physical, Logical, and Administrative Controls. What are each best for?
- Physical: Best for deterring unauthorized physical access.
- Logical: Effective for securing data and networks.
- Administrative: Helpful for creating a security-aware culture.
Categorize Cybersecurity Principles According to Area of Impact
* Data Protection:
* Network Security:
* User Authentication:
- Data Protection: Encryption, backups.
- Network Security: Firewalls, VPNs. * User Authentication: MFA, strong passwords.
What kind of attack does Encrytion mitigate?
Interception
What type of attack do Firewalls protect against?
Mitigate interruption
What do digital signatures mitigate?
fabrication and modification.
Classify Attacks According to Cybersecurity Concept Violated- Phishing
Violates user authentication.
Classify Attacks According to Cybersecurity Concept Violated- DDoS
Violates availability
Classify Attacks According to Cybersecurity Concept Violated- Data Breach
Confidentiality
Identify Cybersecurity Concepts that Protect Critical Information (3x)
- Data Encryption * Firewalls * Multi-factor Authentication
Identify Types of Assets or Resources that Can be Secured
- Hardware: Servers, workstations. * Software: Applications, databases. * Data: Files, intellectual property.
Categorize Security Principles According to Type of Asset Needing Protection - Software
Logical Controls
Categorize Security Principles According to Type of Asset Needing Protection - Hardware
Physical Controls
Categorize Security Principles According to Type of Asset Needing Protection - data
logical and administrative controls
Classify Threats and Attacks According to CIA Triad
* Interception:
- Interception: Targets confidentiality.
Classify Threats and Attacks According to CIA Triad
* Interruption:
- Interruption: Targets availability.
Classify Threats and Attacks According to CIA Triad
* Modification:
- Modification: Targets integrity.
Classify Threats and Attacks According to CIA Triad
* Fabrication:
- Fabrication: Targets both integrity and authenticity
Categorize Control Mechanisms
* Physical Controls
- Physical Controls: Mitigate risks of unauthorized physical access.
Categorize Control Mechanisms
* Logical Controls
- Logical Controls: Mitigate risks of data breaches.
Categorize Control Mechanisms
* Administrative Controls
- Administrative Controls: Mitigate risks of human error.
Align Types of Attacks to the Legs of the CIA Triad * Violates confidentiality.
Interception:
Align Types of Attacks to the Legs of the CIA Triad* : Violates availability.
Interruption
Align Types of Attacks to the Legs of the CIA Triad* : Violates integrity.
Modification
Align Types of Attacks to the Legs of the CIA Triad* : Violates integrity and can lead to false data becoming available.
Fabrication
What is a threat?
Identification of what harm to the company can occur if important information is released.
What describes risk assessment?
Risk occurs when there is a matching threat and vulnerability. A risk assessment determines which risks require concern during the operations security process.
What is the responsibility of the Cybersecurity and Infrastructure Security Agency (CISA).
Lead the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure.
