OPSEC, critical and sensitive information protection strategy
Iñigo Ladrón Morales
That information (both personal and corporate) is power, it is nothing new. That, furthermore, with it (whether it is used well or poorly) very profitable businesses can be generated, is also not news.
Unfortunately, we are very accustomed to providing on a daily basis (with consent, explicit, express, informed, tacit, etc., or not) data of a personal, business, corporate, confidential, and even critical nature, as “currency” for the provision of services (usually free, but not always), or for other reasons.
We already know that we must protect information. But, this leads us to the fact that perhaps we should go one step further, especially in the case of companies and organizations that handle data, their own or third parties (customers, employees, suppliers, partners, etc.), of a sensitive nature and/or or confidential.
It is one more piece in the Risk management corporate risks, which must be mitigated through mechanisms and actions of physical security, logical security (cybersecurity).
Before managing risks, we must know what the risks are. assets to protect who could be affected by threats and be potential victims of its access, modification or extraction (data exfiltration or leakage). Obviously it will be information, will be the data. However, what we need to find out is what exactly they are? Where are they? What type are they? How are they stored and managed? etc. That is, we must carry out a prior task of discovery and classification.
With all this, we will be clearer about what data we are going to protect and how we should do it due to its characteristics.
This is the objective of the processes and services ORPSEC (Operational Security), which come to cover these needs. With them we will be able to avoid cases of information leakage establishing methodology and mechanisms of data protection and data loss prevention (data loss prevention, or DLP).
With a comprehensive OPSEC service, an organization's important information is identified, classified and protected while, at the same time, countermeasures protection to make it difficult for adversaries to obtain critical information.
The objective of a 𝗢𝗣𝗦𝗘𝗖 service, therefore, is to protect the sensitive information and the critical information of an organization, identifying potential threats and establishing effective countermeasures to mitigate risks.
It consists of a complex service with different activities that range from an exhaustive preliminary analysis of the information managed by the company, with its identification and classification, to the establishment of all types of protection measures:
- Identification of critical and sensitive information. Work must be done to determine what existing information is what should really be considered critical and/or sensitive for the company.
- Classification of information, by types and degrees. When we have already identified the information to be protected, and given that not all types of information will be protected in the same way, we must know its characteristics, based on two factors: its importance in the organization and sensitivity level.
- Identification of potential threats. If we already know the information to be protected, what type it is, and even the level of importance and sensitivity, it is time to find out what threats (external or internal and of all kinds) could put the security of that specific information at risk.
- Vulnerability scan. By knowing the assets and the threats that could affect them, in addition to the way in which the information is stored, processed and managed, we will be able to identify possible security holes and weaknesses to correct in the management of said information.
- Countermeasure development. Let's address the prevention in detail from all the prior knowledge acquired, defining, building, developing and implementing measures (technical or non-technical), procedures, tools, services, techniques, resources, and proactive protection capabilities.
- Implementation of countermeasures. Let's deploy, apply, launch and configure the measures developed, ensuring that they are applied correctly.
- Review and continuous process. Of course, an exercise or service OPSEC It is not something isolated that is done on one occasion to cover the file and that's it. This is a continuous process that requires constant evaluation of assets (data, information), potential threats, vulnerabilities and existing countermeasures. Only this will ensure that critical and sensitive information continues to be protected.
Regularly applying this type of evaluations or services OPSEC We will be able to improve the security of our company and its data, obtaining important benefits for the organization:
- Protection against threats, external and also internal We already know that threats can be external (cybercriminals, cyberattacks, for example) and also of an internal nature (insiders who act intentionally or unintentionally). A service OPSEC will allow us to protect both cases, which is why it provides a Comprehensive data protection.
- Risk reduction. Since the risks associated with assets are discovered and mitigated by being able to establish measures in advance, this translates into a reduction in cases of loss of critical information.
- Regulatory compliance (compliance). Many companies are required to comply (and even be certified) under certain frameworks, regulations, standards or regulations security and data protection (LOPD, LOPDGDD, RGPD/GDPR, ENS, NIS, DORA, among other). Performing exercises or services OPSEC helps ensure the normative compliance of these companies.
- Informed decision making. By protecting the organization's critical information, it is easier to make more informed and, therefore, more solid strategic decisions based on secure and reliable data.
However, not all companies are trained or prepared to carry out this type of exercise of introspection, analysis and establishment of measures, and must request the provision of professional services by OPSEC experts. That is, it is likely that a company lacks characteristics such as the following to implement it on its own:
- Conscience. Where, if not all, an immense part of the organization's staff knows the importance of data security and protection, as well as what the operations security services.
- Knowledge and skills. In this case, in addition to having awareness, what a company should have are resources and capabilities (human, technical and economic) to execute plans. OPSEC internally at their own expense.
- Limited resources. Even if the two previous aspects are met, it is more than likely that an organization lacks the personnel and budget to implement measures of this type internally.
- State of the art and continuous evolution of threats. Another factor against is that the threats, techniques and attack technologies for obtaining data change constantly and at a dizzying pace for a company that is not dedicated to cybersecurity to be able to cope with it.
For these reasons, it is always more advisable to have experts to help us execute this type of operations security services (OPSEC), taking into account both physical and logical security and implementing countermeasures that make it difficult for the cyber attacker can get to know information and characteristics of the data that the organization has.
Does your company have the necessary capacity and skill to carry out OPSEC activities?
Does your company need help with this type of services, like the ones we offer at Zerolynx: 𝗦𝗲𝗴𝘂𝗿𝗶𝗱𝗮𝗱 𝗱𝗲 𝗹𝗮𝘀 𝗢𝗽𝗲𝗿𝗮𝗰𝗶𝗼𝗻𝗲𝘀 (𝗢𝗣𝗦𝗘𝗖)?
You can expand details about our services visiting the page of Zerolynx.
If you prefer, contact us and we talked.
