OPSEC Fundamentals

Learning Objectives

• After this, students can define OPSEC and explain how it differs from general information security.
• After this, students can describe where OPSEC came from (Operation PURPLE DRAGON) and how it became a formal government process.
• After this, students can apply the five-step OPSEC process to an OSINT investigation.
• After this, students can build a simple threat model for themselves as an investigator.
• After this, students can match the level of OPSEC effort to the actual threat.

What OPSEC Is

OPSEC (Operations Security) is a process for identifying the information that would hurt you if an adversary learned it, and then denying the adversary that information. In this module, you are the one being protected: the investigator doing OSINT research. (Protecting people and organizations from OSINT is covered in Module 9.)

The key idea behind OPSEC is the indicator: a small, often harmless-looking clue that, combined with other clues, reveals something important. A single LinkedIn profile view doesn’t reveal much. Forty profile views of one company’s IT staff in twenty minutes, from an account at a security consulting firm, tells that company’s security team that someone is preparing to test (or attack) them.

That is the same “mosaic effect” covered in Legal & Ethical Boundaries, pointed in the other direction. OSINT works because targets leak indicators. OPSEC is how investigators avoid leaking their own.

OPSEC vs. information security

	Information security (InfoSec)	Operations security (OPSEC)
Main question	“Is our data protected from unauthorized access?”	“What can an adversary figure out from what we do and what we expose?”
Typical focus	Encryption, access control, patching, firewalls	Behavior, patterns, public traces, small clues
Example failure	A database is hacked	An analyst’s profile views tip off the target

Both matter. A perfectly patched, encrypted laptop does nothing to stop you from liking a target’s photo by accident.

Why investigators need it

• The investigation gets burned. If a target notices you, they can delete posts, lock accounts, change their behavior, or feed you false information. Your findings stop reflecting reality.
• Retaliation. Threat actors and some individuals research the people researching them. Consequences range from harassment and doxxing to legal threats.
• Client and employer exposure. On a paid engagement, revealing who you work for can reveal who your client is, which may breach a contract or NDA.
• Evidence problems. If a subject learns they are being investigated, evidence can disappear before it is captured.

OPSEC is not about hiding illegal activity. It protects legitimate, authorized research. Everything in this module still operates inside the rules in Module 2 (Legal & Ethical Boundaries).

Where OPSEC Came From: Operation PURPLE DRAGON

• When and why: In 1966, during the Vietnam War, US commanders were seeing combat operations fail in ways that suggested the enemy had advance warning. Air campaigns such as Rolling Thunder (fighter-bomber strikes) and Arc Light (B-52 strikes) against North Vietnam were a particular concern, and US aircraft losses were mounting.
• Who: Admiral U.S. Grant Sharp (Commander in Chief, Pacific), with the Joint Chiefs of Staff, set up a multidisciplinary survey team that included personnel from the National Security Agency (NSA) and the Department of Defense. The effort got the unclassified code name PURPLE DRAGON.
• What they looked at: Instead of assuming spies or code-breaking, the team examined how US forces’ own routine activities (planning, communications, logistics, and procedures) were giving away what was about to happen. The enemy didn’t need secret documents when patterns in unprotected activity told the story.
• The result: The team codified its recommendations and called the approach “Operations Security” to distinguish it from existing security disciplines. PURPLE DRAGON-style surveys spread across US military commands.
• Formalization: In 1988, President Reagan signed National Security Decision Directive 298 (NSDD-298), which established the National Operations Security Program and the five-step OPSEC process still taught today.

Teaching point: OPSEC was born from the realization that unclassified, observable behavior can be just as revealing as stolen secrets. That is exactly the premise of OSINT.

The Five-Step OPSEC Process

NSDD-298 formalized five steps:

1. Identify critical information
2. Analyze threats
3. Analyze vulnerabilities
4. Assess risk
5. Apply countermeasures

These are steps in a loop, not a one-time checklist. Revisit them whenever the investigation changes: a new target, a new platform, or signs that someone has noticed you.

Worked example: an authorized OSINT assessment of Company X

You work for a security consulting firm. Company X has hired your firm to assess its external exposure before a phishing simulation. Only Company X’s CISO knows about the engagement.

Step 1: Identify critical information. What would hurt the engagement if the wrong people learned it?
- That Company X is being assessed at all (a heads-up changes employee behavior and invalidates the phishing test)
- Which employees you are focusing on
- Your identity and your firm’s name (which reveals the client relationship)
- Your research accounts, tools, and infrastructure
- Your findings (a roadmap for real attackers)

Step 2: Analyze threats. Who might notice or want that information, and what could they do with it?
| Adversary / observer | What they might do |
|—|—|
| Company X employees | Notice LinkedIn views, mention it to IT, become suspicious of emails |
| Company X IT/security staff (who don’t know about the test) | Spot unusual traffic in web logs, block IPs, alert leadership |
| Real threat actors targeting Company X | Watch public scan sites for Company X domains; learn what you found |
| Your own social circle / the public | Learn client names from careless posts |

Step 3: Analyze vulnerabilities. How could the critical information leak?
- Viewing profiles on LinkedIn with your real, firm-branded account
- Browsing Company X’s website from your firm’s office network (your firm’s IP range is publicly registered to your firm)
- Submitting Company X URLs to public scanners with default “public” visibility
- A sock puppet account tied to your personal phone number
- A report PDF whose metadata shows your name and your firm’s internal file path
- A social media post: “Big recon week for a Fortune 500 client in Denver!”

Step 4: Assess risk. For each vulnerability, estimate how likely it is to be exploited and how bad the impact would be. A simple matrix works:

Vulnerability	Likelihood	Impact	Priority
Firm-branded LinkedIn views	High	High (tips off employees)	Fix now
Office IP in web logs	Medium	High (identifies firm)	Fix now
Public urlscan submissions	Medium	Medium	Fix now (it’s a free fix)
Report metadata	Low (report goes only to the client)	Medium	Fix before delivery

Step 5: Apply countermeasures.
- Use LinkedIn private mode or a research account approved in the rules of engagement
- Research from an isolated environment on a network that doesn’t trace back to your firm
- Set scanner submissions to private
- Keep sock puppets on separate phone numbers and emails, per your firm’s policy
- Strip metadata from deliverables and review them before sending
- Don’t discuss clients publicly

Notice that most countermeasures are cheap. OPSEC is mostly discipline, not expensive tools.

Threat Modeling for Investigators

Threat modeling is the structured way of answering “What could go wrong, and who could make it happen?” Before any investigation, ask:

1. What am I protecting? (my identity, my client, my methods, my findings, my personal safety)
2. Who might want it or notice me? (the target, their security team, their friends, threat actors, the public)
3. What can they actually do? (check logs, see profile views, run their own OSINT on me, retaliate)
4. How likely is that, and how bad would it be?
5. How much effort is reasonable to prevent it?

Adversary capability tiers

Tier	Examples	What they can realistically do
Low	A small business, an ordinary private individual	Notice obvious interactions (likes, follows, profile views); rarely check logs
Medium	A company with a security team, a tech-savvy individual, journalists	Review web logs, watch scan sites for their domains, plant tracking links or canary tokens, run OSINT on you
High	Organized cybercriminals, ransomware groups, nation-state actors	Actively hunt researchers, set traps, dox and harass, use malware, pursue legal or physical retaliation

Matching OPSEC to the Threat

OPSEC has costs: time, money, convenience, and sometimes the quality of your research (Tor is slow, some sites block VPNs). Too little OPSEC gets you burned; too much slows you down for no benefit. Scale your precautions to the threat tier.

Investigation	Threat tier	Reasonable baseline
Finding a company’s email format for an authorized phishing test	Low–Medium	Separate browser profile, not logged into personal accounts, LinkedIn private mode, private scan submissions
Full external assessment of a company with a mature security team	Medium	Dedicated VM, network that doesn’t trace to your employer, approved research accounts, careful logging and data handling
Monitoring a ransomware group’s public channels (with authorization)	High	Isolated and disposable environments, hardened browser, strict persona separation, no downloads on the host, legal and organizational sign-off (see Module 6)
Investigating a private individual’s harassment campaign against a client	Medium–High	Strong separation from personal identity, consider personal safety, extra care with any interaction

The OPSEC Mindset

• Assume everything is logged. Every page load, click, and login leaves a record somewhere.
• Compartmentalize. Keep research, personal life, and different investigations separated (next file covers how).
• Minimize. Touch the target as little as possible; collect only what you need.
• Be consistent. Mismatches (a persona “in Chicago” posting at 3 a.m. Chicago time) are indicators too.
• Mistakes are permanent. A single slip can’t be undone, because archives, logs, and screenshots persist. Many famous OPSEC failures were one moment of carelessness (see 8.4-common-opsec-mistakes.md).
• OPSEC failures are how OSINT succeeds. Studying why targets get caught teaches you what to avoid yourself.

Key Terms

• OPSEC (Operations Security): a process for identifying critical information and denying adversaries the indicators that would reveal it.
• Critical information: facts about your activity that would cause harm if an adversary learned them.
• Indicator: an observable clue (a profile view, an IP address, a timestamp) that can reveal critical information, alone or combined with others.
• Adversary: anyone who might notice, collect, or misuse your critical information; not always a criminal.
• Countermeasure: an action that removes or reduces a vulnerability.
• Threat model: a structured description of what you’re protecting, from whom, and how.
• Attribution: linking an activity back to the person or organization behind it.
• Compartmentalization: keeping identities, activities, and data separated so one leak doesn’t expose everything.
• NSDD-298: the 1988 presidential directive that established the US National OPSEC Program.

Key Takeaways

• OPSEC protects the investigator: your identity, intentions, client, and findings.
• OPSEC came from Operation PURPLE DRAGON (Vietnam War, 1966) and was formalized by NSDD-298 in 1988.
• Five steps: identify critical info → analyze threats → analyze vulnerabilities → assess risk → apply countermeasures.
• Small indicators add up; the mosaic effect works against investigators too.
• Match OPSEC effort to the threat: an email-format lookup ≠ investigating a ransomware gang.
• Most countermeasures are discipline, not expensive tools.
• One slip can’t be undone, so plan before you start.

References

• OPSEC: The History of the Purple Dragon — DVIDS
• PURPLE DRAGON: The Origin and Development of the United States OPSEC Program — NSA (PDF)
• PURPLE DRAGON — Internet Archive copy
• Operations security — Wikipedia
• National Security Decision Directive 298 — FAS
• DHS Management Directive: Operations Security Program (PDF)
• What is OPSEC? — TechTarget