# data[].attributes.body
Risk = Threat x Vulnerability x Impact

Risk is the likelihood that a threat will exploit an asset’s vulnerability causing impact to business.
(J.L)

# data[].attributes.headline
What is an example to show Operations Security at work in an organisation?

# data[].attributes.subject
What is an example to show Operations Security at work in an organisation?

# data[].attributes.body
Another example is to use tools. when business run untrusted program and web browser in a sandbox tool like virtual studio to confine information security attacks to a virtual environment(Javier)

# data[].attributes.body
Operational security policy:
There should be clear guidelines on what operators are allowed to do and what they are not allowed to do. Escalation paths need to be defined that outline the steps to follow if an operator does not have the authorization required for a specific action. The operational security policy should clearly define the responsibilities and authorization, as well as disciplinary actions in case of breaches. The policy also acts as a deterrent against deliberate misconfigurations.

Change management process: Every company running a network should create precise processes that define and control how changes to the network are executed. The state of the hardware, operating system, and configurations should be monitored, and all changes should be logged and executed in a controlled way. The logs should be evaluated and checked for potential misconfigurations. The logs can also be used to demonstrate a deliberate breach of the operational security policy. (For this, the concept of dual control is important and is discussed below.)

Access control:
It is a good practice to restrict access to network devices. Access restrictions are traditionally implemented in networks via AAA authentication. This security measure is typically executed, although in many networks too many operators have access to network devices. Restricting this number to the minimum amount of operators necessary reduces the risk.

# data[].attributes.body
Authorization:
The access an operator has should be restricted to the minimum access needed for the operator to do their job. In most cases it is not a good idea for all operators to have full-enable access (level 15) to devices. This practice can be more difficult to implement; however, simple distinctions, for example, who can and cannot enter configuration mode, go a long way.

Dual control:
Security control and network control should not be the responsibility of the same group. Ideally, a security group controls who has access to what, and a network group executes the configuration actions. Typically the logs are controlled by the security group. This way it is much harder to deliberately misconfigure devices, since the security team could recognize a misconfiguration in the log files.

Secure and verify:
All of the above measures are active attempts to detect a change in the network, such as a configuration change. It is also possible to detect policy violations by analyzing the traffic on the network, or the state of dynamic information such as routing tables, ARP tables, etc. For example, intrusion detection systems can create alerts when flows are seen on the network that do not correspond to the policy. There are many other ways to monitor for traffic anomalies. For example, Cisco IOS NetFlow can be instrumental in detecting misrouted packets on the network and routing tables can be checked for missing or unknown routing prefixes.

Automation:
It is generally recommended to automate processes and procedures, specifically recurring verification processes, because humans tend to overlook details in log files and similar processes. Automated processes are also less likely to make mistakes, although if a mistake does happen, it is often systematic and therefore easily detectable.

# data[].attributes.body
Accidental misconfigurations: These are accidental in nature, and are by far the most frequent type of operational issue(s). Mistyping a value (such as the route target) is one example, or forgetting statements in a firewall is another example.

Deliberate misconfigurations:
These are misconfigurations done on purpose. They vary in their degree of maliciousness. For example, violation of the security policy to allow an operator's home system access through the corporate firewall is not as likely to be as severe as acts of sabotage by a disgruntled employee.

# data[].attributes.body
The purpose of OPSEC is to reduce the vulnerabilities and multinational forces from successful adversary exploitation of critical information.
(J.L

# data[].attributes.body
-  Strategic advantage
-  Operational advantage
-  Financial advantages
-  Helps in compliance
(TianLe)

# data[].attributes.body
-  Needs a healthy investment to establish a good security management system
-  It makes delay in our decision
-  Needs continues up gradation in security management system
(TianLe)

# data[].attributes.headline
What is an example to show Operations Security at work in an organisation?

# data[].attributes.subject
What is an example to show Operations Security at work in an organisation?

# data[].attributes.body
An example is Secure Locations. It is a process when mergers & acquisition talks that take place at a private location provided by advising banks. Talks may be confined to a single room with a focus on using paper documents that can't be removed from the room. (Javier)

# data[].attributes.headline
5 steps in operations security (OPSEC process)

# data[].attributes.subject
5 steps in operations security (OPSEC process)

# data[].attributes.body
- Identification of Critical Information
- Analysis of Threats
- Analysis of Vulnerabilities
- Assessment of Risks
- Application of Appropriate Countermeasures
(TianLe)

# data[].attributes.body
Layer 8 is a term utilized by information security professionals and techies in general that represents the weakest link of every organization . Even if physical and virtual are strong, there still ways to exploit them.

(J.L)

# data[].attributes.body
Identify critical information to
determine if friendly actions can be observed and see whether any useful information can be useful.
(J.L)