Operations Security (OpSec) is the process by which we protect unclassified information that can be used against us. It is an analytical process that classifies information assets and determines the controls required to protect these assets. In other words, OpSec challenges us to look at ourselves through the eyes of an adversary. For example:
Vulnerability Assessment and Penetration Testing
- Vulnerability assessment can be used to discover which vulnerabilities are present in a system and where they are located.
- Penetration tests can then be used to exploit the vulnerabilities in a system to determine whether unauthorized access or other malicious activity is possible and identify which flaws pose a threat to the application.
This process gives detailed picture, in advance, of the flaws that exist in a system and the risks associated with those flaws, which can then be used to protect information by applying countermeasures thereby, denying the adversary the ability to act.\
========================================================================
Physical Security
The need to secure physical locations, hardware, and software from threats— arose during World War II when the first mainframes, developed to aid computations for communication code breaking, were put to use. Multiple levels of security were implemented to protect these mainframes and maintain the integrity of their data.
Physical and environmental Threat
- Emergencies
- Service interruptions
- Natural disasters
- Sabotage
Also
- Brownouts
- Fire detection and Suppression
- HVAC
How to protect against these? The answer is Physical Security such as:
- Locks
- Alarm
- CCTVs
- Security Guards
Physical security encompasses
- the design,
- implementation,
- and maintenance of
countermeasures. The countermeasures that help protect the physical resources that control information of an organization while in transmission, processing and storage. Physical Resources includes
- people,
- hardware,
- supporting system elements
Most technology-based controls can be circumvented if an attacker gains physical access to the devices being controlled. For example:
If it is easy to steal mobile phones, tablets, laptops, hard-drive from an organization then the information on those devices is not secure. Therefore, physical security is just as important as logical security to an information security.
===========================================================================The Era of Mobility
In an era of mobility, physical security is of indispensable. Most mobile computing systems such as PDAs (portable digital handhelds), laptops etc. have valuable information stored within them. For example:
- Some devices may be configured to facilitate user access into the organization’s secure computing facilities through VPN.
- While many users keep passwords, locations of files and quick clues about the storage of information in their portable devices.
- Also, many users likes underlying operating systems to remember their usernames and passwords for it provides easier access.
What is the associated problems?
The information and the access control mechanism is lost if the device is lost or stolen.
Solution:
- For maximum security, mobile devices should be secured at all times. If you are traveling, you should have it in your possession at all times.
- For additional security, install new technology to help locate lost or stolen mobile devices.
- During off-hours, lock the mobile devices. Be aware that if device is stolen, automatic logins can make it easy for a thief to send inappropriate messages with your account.
