29 Aug 2023

Everything You Need to Know About Operational Security (OPSEC): Why, What, and How

Aaron Dixon

Operational security (OPSEC) is a fundamental component of any intelligence investigation. Although the term has its origins in the military environment, it has come to have greater importance in the fields of Cyber Threat intelligence (CTI), person of interest analysis and certainly during Open-Source Intelligence (OSINT) investigations. The aim is to ensure protection; be it in regard to the integrity of the investigation, or the safety of the investigators themselves. This guide will serve to help you to define OPSEC, provide a basic methodology for determining your “threat environment”, and provide some mitigation measures to reduce the threat to you by implementing additional protection measures for use during your investigations.


What is OPSEC? 🔗︎

Firstly, what is OPSEC? The definition has been clearly defined in the military as “a capability that identifies and controls critical information, indicators of friendly force actions attendant to military operations, and incorporates countermeasures to reduce the risk of an adversary exploiting vulnerabilities.” In the OSINT sphere, it has also been defined to mean “the collective steps that investigators can formulate into a process that they can follow during an OSINT investigation to remain anonymous and keep their activity undiscovered. OPSEC can be achieved through a combination of software, hardware, and actions.” Both definitions are valuable in that our end goal is to combine elements of both into our particular mission statement.

With OPSEC, we seek to:

  • Identify and control critical information
  • Reduce the risk of an adversary exploiting vulnerabilities
  • Conceal our real identity and seek to remain anonymous
  • Keep our activities undiscovered or difficult to track

On the one hand, we want to protect practitioners of OSINT investigations from disclosing any information about themselves or those they associate with, as well as to ensure that our targets remain unaware of our scrutiny. As to the first point, OSINT influencer Nico Dekens states, “We all have something to protect or hide”. Were we to expose ourselves to the targets of our investigations, we are providing them with a target; we should always seek to remain hidden, observe and report – exposure means increased personal risk. As to the second point which very much follows from the first, alerting the targets of our investigations may lead them to change their behaviors, with potentially catastrophic consequences. Our target may reduce our access to previously available information by deleting social media accounts, removing images and posts from forums, notifying other target members, etc. Never pretend that the targets of our investigations will not seek to hinder our activities if they can do so.

Because the information which we seek to find, that which we seek to protect, and the types of investigations which we engage in will change, you will need to adapt your OPSEC to your current situation. To do so, you will need to conduct threat modelling. The following section will explain how to do just that.

As a side note, please also remember that OPSEC measures in and of themselves can provide indications as to both who is engaging in an investigation, and their level of professionalism. For instance, using a Sock Puppet account with an IP that can be tracked back to the federal police is a sure way to inform your target that they are under investigation.

How to Threat Model for OPSEC 🔗︎

OPSEC is not a static concept. Depending on the types of activities you are conducting, you will need to adapt your OPSEC measures. In order to evaluate your activities, their risk, and the necessary measures to be implemented, we need to conduct threat modelling. This allows us to determine the degree of security which we want to achieve. This threat modelling can be done in a fairly informal manner, merely by taking the time to write down the basic information pertaining to the following points:

  • Know your target. A project investigating Threat Actors or organized crime groups, or malware and its developer, has a different level of OPSEC requirements from a project looking into the social media profile of a 16-year-old forum troll.
  • Identify potential threats. Possible threats to sensitive data need to be identified and potentially documented. Consider that threats may exist externally through third parties, as well as internally. Data theft or breaches (either accidental or deliberate) can publish a wealth of data about you personally without your knowledge.
  • Analyze security vulnerabilities. You must perform an objective analysis of your current security measure implementation strategy. Look for potential weaknesses which can be exploited. This covers all types of vulnerabilities, from cross-usage of devices to digital foot printing, usage of specific monitoring/tracking tools, etc.
  • Determine the risk level of each vulnerability. Consider the damage that could be caused should your data be compromised, or if the organization may suffer as a result of your laxity.

It is recommended that, having gathered the information relating to the points, you speak to the relevant individuals who can help you with evaluating whether you belong to the group needing to implement Level 1 OPSEC measures, or Level 2. This may be the Chief Technical Officer (CTO) and/or Information Security Officer (ISO); all organizations are different but should have someone who is an authority and who can help guide your assessment.

Having done this, you can then move on to the next step of the OPSEC process:

  • Implement a mitigation plan. Having determined all the necessary information, you can start to build up a mitigation plan which includes those technical and organizational measures to ensure that risks are addressed based on their criticality – avoided, transferred, mitigated, or accepted.

Depending on the results of your Threat Modelling, the measures which you may implement could consist of deploying a VPN, creating a Sock Puppet account for the social media platforms you use, and utilizing a password manager.

OPSEC is Integral to Every Operation 🔗︎

Every OSINT investigator should remember that, as stated earlier, there are always risks inherent in investigations. Additionally, OPSEC should be practiced at all times in order to ensure that the behaviors become ingrained and second nature. Even by investigating seemingly innocuous websites, profiles or malware, we may inadvertently put ourselves and others at risk – our OPSEC measures protect us from this potential risk.

Referring once more to the military space, OPSEC is considered integral to every operation as it serves as “a force multiplier that can maximize operational effectiveness by saving lives and resources when integrated into operations, activities, plans, exercises, training, and capabilities.” It may seem hyperbolic, however, better to prepare for the worst and avoid any surprises in the future.

If you leak information about yourself, then you are putting yourself at risk. The types of investigations which you are conducting may sometimes delve into the less savory areas of the internet and focus on real criminal groups or threat actors. Even if these are not the type of investigations you are conducting, and even if you only use Maltego to play with, you should still be following basic OPSEC principles; there are no excuses or exceptions.

Now that you hopefully have a good understanding of the definition, context, and importance of OPSEC, we have provided a list of measures and tools which can assist you here.

Download the Guide to Safeguard Yourself With OPSEC & Security Tools and Measures In Place! 🔗︎

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua and Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia Herzegovina +387
Botswana +267
Brazil +55
Brunei +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde Islands +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Côte d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus North +90392
Cyprus South +357
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea - Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea North +850
Korea South +82
Kuwait +965
Kyrgyzstan +996
Laos +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mayotte +269
Mexico +52
Micronesia +691
Moldova +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Islands +672
Northern Marianas +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russia +7
Rwanda +250
San Marino +378
Sao Tome & Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovak Republic +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
St. Helena +290
St. Kitts +1869
St. Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syria +963
Taiwan +886
Tajikstan +7
Thailand +66
Togo +228
Tonga +676
Trinidad & Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +7
Turkmenistan +993
Turks & Caicos Islands +1649
Tuvalu +688
Uganda +256
UK +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
USA +1
Uzbekistan +7
Vanuatu +678
Vatican City +379
Venezuela +58
Vietnam +84
Virgin Islands - British +84
Virgin Islands - US +84
Wallis & Futuna +681
Yemen +969
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up for our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author 🔗︎

Aaron Dixon

Aaron Dixon is a former member of the New Zealand Military who has spent the last 6 years working as a consultant in the areas of IT Security and Compliance, Data Privacy, Digital Forensics and Cyber Threat Intelligence. He holds a bachelor’s degree with a double major in History and Defense Studies, as well as a Postgraduate Certificate in International Security. His primary areas of interest are terrorism and geopolitical conflict, as well as focusing on the foundational processes and principles of the Intelligence Cycle.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.