OPSEC Process Five Steps with Complete Solutions

OPSEC Process Five Steps with Complete Solutions Identification of critical information - Answer-- The information that an adversary would need in order to degrade services, disrupt operations, and impact the reputation of an organization. What are the OPSEC five steps? - Answer-1. Identification 2. Analysis of threats 3. Analysis of vulnerabilities 4. Assessment of risks 5. Application of appropriate countermeasures Identification of critical information (Step 1) - Answer-The information that an adversary would need in order to degrade services, disrupt operations, and impact the reputation of an organization. Examples for step 1 - Answer-- Core network infrastructure - Information security capability - Business information - Business critical applications - Employee information - Intellectual property Business information - Answer-Mergers and acquistion Business critical applications - Answer-- Manufacturing applications - Enterprise resource management platforms Employee information - Answer-Identification of system administrators Intellectual property - Answer-- Planning documentation - Schematics - Blueprints Analysis of threats (Step 2) - Answer-Deals with identification the adversaries, their intent, and their capability to use the information against an organization. Once we identify the threats, we can study their Techniques, Tactics, and Procedures (TTPs) and start prioritizing how we can monitor for those specific activities. Analysis of vulnerabilities (Step 3) - Answer-- A vulnerability is the state of being unprotected from the likelihood of being attacked, physically or emotionally. - By understanding the adversary their intent, and their capability, an organization can focus on identifying the potential vulnerabilities that exist in the enterprise. Assessment of risks - Answer-- Once vulnerabilities are identified the vulnerabilities must go through the organizations process. This process evaluates each vulnerability and assigns it based on the sum of the probability of exploitation and impact to organization.