Which of the following are known as the three laws of OPSEC?
Each correct answer represents a part of the solution. Choose three.
A.
If you don’t know the threat, how do you know what to protect?
B.
If you don’t know what to protect, how do you know you are protecting it?
C.
If you are not protecting it (the critical and sensitive information), the adversary wins!
D.
If you don’t know about your security resources you cannot protect your network.
Explanation:
OPSEC is also known as operations security. It has three laws.
The First Law of OPSEC. If you don’t know the threat, how do you know what to protect? Although
specific threats may vary from site to site or program to program. Employees must be aware of the
actual and postulated threats. In any given situation, there is likely to be more than one adversary,
although each may be interested in different information.
The Second Law of OPSEC. If you don’t know what to protect, how do you know you are protecting
it? The “what” is the critical and sensitive, or target, information that adversaries require to meet
their objectives.
The Third Law of OPSEC. If you are not protecting it (the critical and sensitive information), the
adversary wins! OPSEC vulnerability assessments, (referred to as “OPSEC assessments” – OA’s – or
sometimes as Surveys”) are conducted to determine whether or not critical information is
vulnerable to exploitation. An OA is a critical analysis of “what we do” and “how we do it” from the
perspective of
an adversary. Internal procedures and information sources are also reviewed to determine whether
there is an inadvertent release of sensitive information.
Answer option D is incorrect. The statement given in the option is not a valid law of OPSEC.