Opsec Process Steps

- The information that an adversary would need in order to degrade services, disrupt operations, and impact the reputation of an organization.

1. Identification 2. Analysis of threats 3. Analysis of vulnerabilities 4. Assessment of risks 5. Application of appropriate countermeasures

The information that an adversary would need in order to degrade services, disrupt operations, and impact the reputation of an organization.

- Core network infrastructure - Information security capability - Business information - Business critical applications - Employee information - Intellectual property

Mergers and acquistion

- Manufacturing applications - Enterprise resource management platforms

Identification of system administrators

- Planning documentation - Schematics - Blueprints

Deals with identification the adversaries, their intent, and their capability to use the information against an organization. Once we identify the threats, we can study their Techniques, Tactics, and Procedures (TTPs) and start prioritizing how we can monitor for those specific activities.

- A vulnerability is the state of being unprotected from the likelihood of being attacked, physically or emotionally. - By understanding the adversary their intent, and their capability, an organization can focus on identifying the potential vulnerabilities that exist in the enterprise.

- Once vulnerabilities are identified the vulnerabilities must go through the organizations process. This process evaluates each vulnerability and assigns it based on the sum of the probability of exploitation and impact to organization.

- Certain - Likely - Possible - Unlikely - Rare

- Negligible loss - Marginal Loss - Moderate Loss - Critical Loss - Catastrophic Loss

100% chance it will happen

>80% chance it will happen

60-79% chance it will happen

11-59% chance it will happen

Less than 10% chance it will happen

If this happens, it won't bother us to much.

If this happens, it will be an annoyance, but we can get by.

There will need to be a few projects to get us back to where we were.

There will be some major projects to get us back to where we were.

We need to start from the beginning because there will be nothing left.

- High - Medium - Low

After the risk assessment, organizations should be able yo prioritize resources to do - Avoid the risk - Control/mitigate the risk - Accept the risk - Transfer thee risk

Change planning to work around the problem.

Isolate the problem and reduce the impact to the organizations: - Network segmentation - Access control lists - Credential management

Acknowledge that the problem exists

- Cyber insurance - Service providers