{"id":54707,"date":"2022-08-11T09:23:25","date_gmt":"2022-08-11T01:23:25","guid":{"rendered":"https:\/\/version-2.com\/?p=54707"},"modified":"2022-08-19T15:16:54","modified_gmt":"2022-08-19T07:16:54","slug":"opsec-or-how-to-behave-when-you-care-about-your-behaviour","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/08\/opsec-or-how-to-behave-when-you-care-about-your-behaviour\/","title":{"rendered":"OpSec or How to Behave When You Care About Your Behaviour"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>\n

Intro<\/h3>

Alrighty! This one has long been on my to-do list! OpSec! Why, how, when, who\u2026 how much and how long\u2026 Let\u2019s see! Let\u2019s answer some questions. Whether you\u2019re sleuthing for some OSINT investigation, or your country is blocking you from watching your favorite shows on Netflix, you need to figure out your <\/em>specific OpSec needs, and behave accordingly.<\/p>

This one is a particularly interesting topic, as it combines a lot of elements \u2013 from purely technical to some psychological\/behavioural ones.<\/p>

Before I go further into the topic, I would emphasize that this is my <\/em>opinion. You can always argue the technicalities, sure, but the methodology is unique \u2013 as it should be \u2013 again, in my<\/em> opinion. (Though in this article I am not discussing that many technical aspects)<\/p>

This is quite logical, as we all have different needs, and are encapsulated within different contexts. What\u2019s true in my case might not necessarily be true in yours. So, with that in mind one might ask \u2013 what\u2019s there to learn, then? And it is a valid question! However, we\u2019re interested in the approach here \u2013 which is also unique to each and every one of us.<\/p>

My goal here is to help you be more involved in taking the control of your own privacy and having a healthier and safer online presence which surely accounts to a large portion of your life in general, as we\u2019re all getting more and more dependent on myriad of online services.<\/p>

Now that I\u2019ve made the intro, and safely fenced off from the personal aspect involved in this topic \u2013 let us proceed.<\/p>

Basics<\/h3>

At its core, OpSec is just managing risk. In the personal case (one I\u2019m looking at), the risk comes from whatever you <\/em>deem worthy of incorporating into your model. Thus, you\u2019d also want to have a threat model \u2013 no need to go overboard here though. This is just meant in a context of you identifying what information you\u2019d want to protect at all costs i.e., no leaks, or if there\u2019s some that you might be fine with being discovered. I purposefully lead with the first sentence above, as you will probably encounter many definitions \u2013 but the bottom line is always about that I\/O of your personal information. You want <\/em>to control both I and O in the I\/O, but you definitely have <\/em>to focus on the O \u2013 in other words, your model<\/em> and the way you conduct yourself should be in sync with what you\u2019re trying to achieve. Again, based on the model.<\/p>

You want to prioritize as well. Best practices are best practices for a reason but will deteriorate rapidly if applied blindly (without context to match). I debated with myself whether to include best practices at the end of this article and opted for it in the end. The argument against it was backed by the second sentence of this paragraph. I am counting on you here!<\/p>

Traditionally, there are stages when it comes to OpSec (well, for 3 letter agencies and Military it really makes sense) and I will mention that here as well. However, I want to emphasize that I am doing that for the contextual and historical reasons, as well as for you to be more informed. In the end, though, you\u2019re not required to draft any complex models based on the ones Military uses. Their threat model is surely different than yours, so their OpSec needs are too. The methodology\/approach is what you should focus on. Thus, before taking any action first, take a pause and contemplate on it. The future you will be better off i.e., safer online.<\/p>

Defining OpSec<\/h3>

Okay! I am now going to reference some definitions <\/em>so you can see how that compares to what I\u2019ve been trying to convey.<\/p>

1 \u2013 (Published by Range Commanders Council, U.S. Army White Sands Missile Range \u2013 full .pdf document found here<\/a>)<\/p>

The OPSEC is a process of identifying, analyzing, and controlling critical information indicating friendly actions attendant to military tactics, techniques, and procedures (TTPs), capabilities, operations, and other activities to:<\/em><\/p>