OPSEC (operations security) is a security and risk management process and strategy that classifies information, then determines what is required to protect sensitive information and prevent it from getting into the wrong hands. Show
OPSEC gets information technology (IT) and security managers to view their operations and systems as potential attackers would. OPSEC includes analytical activities and processes, such as social media monitoring, behavior monitoring and security best practices. OPSEC was developed as a methodology during the Vietnam War when U.S. Navy Admiral Ulysses S. Grant Sharp, commander in chief of the U.S. Pacific Command, established the Purple Dragon team to find out how the enemy obtained information on military operations before those operations took place. As a military term, OPSEC described strategies to prevent adversaries or potential adversaries from discovering critical operations-related data. This concept has spread from the military to other parts of the federal government, including the Department of Defense (DOD), to protect national security. As information management and protection have become important to success in the private sector, OPSEC measures are now common in business operations. What are the 5 steps in OPSEC?The processes that make up operations security come down to these five steps: 1. Identify critical information. The first step is to determine what data would be particularly harmful to the organization if an adversary obtained it. This includes intellectual property, employees' or customers' personally identifiable information, financial statements, credit card data and product research. 2. Analyze threats. The next step is to identify who is a threat to the organization's critical information. There may be numerous adversaries who target different information, and companies must consider any competitors or hackers who might target the data. 3. Analyze vulnerabilities. In the vulnerability analysis stage, the organization examines potential weaknesses among the safeguards in place to protect critical information and identifies which ones leave it vulnerable. This step includes finding any potential lapses in physical and electronic processes designed to protect against the predetermined threats or areas where a lack of security awareness training leaves information open to attack. 4. Assess risks. The next step is to determine the threat level associated with each of the identified vulnerabilities. Companies rank the risks according to factors such as the chances a specific attack will occur and how damaging such an attack would be to operations. The higher the risk, the more pressing is the need to implement risk management 5. Apply appropriate countermeasures. The last step involves deploying an OPSEC plan that will reduce the risks. The best place to start is with the risks that are the biggest threat to operations. Potential security improvements include implementing additional hardware and training and developing new information governance Operations security best practicesOrganizations developing and implementing an end-to-end operations security program will want to follow these best practices:
OPSEC and risk managementOPSEC encourages managers to view operations and projects from the outside-in -- that is, from the perspective of competitors or enemies in order to identify weaknesses. If an organization can easily extract its own information while acting as an outsider, the odds are outside adversaries can as well. Completing regular risk assessments is key to identifying vulnerabilities. Risk management encompasses the ability to identify vulnerabilities and threats before they turn into real issues. OPSEC forces managers to do in-depth analyses into their operations and determine where sensitive data can be easily breached. By looking at operations from a bad actor's perspective, managers can spot vulnerabilities they might have missed and they can implement the right OPSEC processes to protect sensitive information. OPSEC trainingThe Center for Development of Security Excellence (CDSE) is part of the DOD's Defense Counterintelligence and Security Agency offers security training for military personnel and DOD employees and contractors. The group uses web-based e-learning formats to present its training programs. Areas covered in CDSE training include:
Occasional users of CDSE courses are taking them on the Security Awareness Hub website where students do not have to register. After the course, participants receive a certificate of completion. However, CDSE does not keep records of who completes the course. CDSE training is also available through its Security, Training, Education and Professionalization Portal, a learning management system portal for all of the organization's security courses. Students taking CDSE courses regularly use the portal, which tracks completion. It also provides a transcript that can then be used to request American Council on Education and continuing education credits. OPSEC strategies and processes are interrelated with the work of SecOps teams. Find out more about the role of SecOps and the security operations center in the enterprise.
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. Globally recognized by developers as the first step towards more secure coding. Companies should adopt this document and start the process of ensuring that their web applications minimize these risks. Using the OWASP Top 10 is perhaps the most effective first step towards changing the software development culture within your organization into one that produces more secure code. There are three new categories, four categories with naming and scoping changes, and some consolidation in the Top 10 for 2021. Efforts have been made in numerous languages to translate the OWASP Top 10 - 2017. If you are interested in helping, please contact the members of the team for the language you are interested in contributing to, or if you don’t see your language listed (neither here nor at github), please email [email protected] to let us know that you want to help and we’ll form a volunteer group for your language. We have compiled this README.TRANSLATIONS with some hints to help you with your translation. 2017 Completed Translations:
Historic:2013 Completed Translations:
2010 Completed Translations:
To collect the most comprehensive dataset related to identified application vulnerabilities to-date to enable analysis for the Top 10 and other future research as well. This data should come from a variety of sources; security vendors and consultancies, bug bounties, along with company/organizational contributions. Data will be normalized to allow for level comparison between Human assisted Tooling and Tooling assisted Humans. Analysis InfrastructurePlan to leverage the OWASP Azure Cloud Infrastructure to collect, analyze, and store the data contributed. ContributionsWe plan to support both known and pseudo-anonymous contributions. The preference is for contributions to be known; this immensely helps with the validation/quality/confidence of the data submitted. If the submitter prefers to have their data stored anonymously and even go as far as submitting the data anonymously, then it will have to be classified as “unverified” vs. “verified”. Verified Data ContributionScenario 1: The submitter is known and has agreed to be identified as a contributing party. Scenario 2: The submitter is known but would rather not be publicly identified. Scenario 3: The submitter is known but does not want it recorded in the dataset. Unverified Data ContributionScenario 4: The submitter is anonymous. (Should we support?) The analysis of the data will be conducted with a careful distinction when the unverified data is part of the dataset that was analyzed. Contribution ProcessThere are a few ways that data can be contributed:
Template examples can be found in GitHub: https://github.com/OWASP/Top10/tree/master/2021/Data Contribution PeriodWe plan to accept contributions to the new Top 10 from May to Nov 30, 2020 for data dating from 2017 to current. Data StructureThe following data elements are required or optional. The more information provided the more accurate our analysis can be. At a bare minimum, we need the time period, total number of applications tested in the dataset, and the list of CWEs and counts of how many applications contained that CWE. If at all possible, please provide the additional metadata, because that will greatly help us gain more insights into the current state of testing and vulnerabilities.
CWE Data
If at all possible, please provide core CWEs in the data, not CWE categories. Note:If a contributor has two types of datasets, one from HaT and one from TaH sources, then it is recommended to submit them as two separate datasets. SurveySimilarly to the Top Ten 2017, we plan to conduct a survey to identify up to two categories of the Top Ten that the community believes are important, but may not be reflected in the data yet. We plan to conduct the survey in May or June 2020, and will be utilizing Google forms in a similar manner as last time. The CWEs on the survey will come from current trending findings, CWEs that are outside the Top Ten in data, and other potential sources. ProcessAt a high level, we plan to perform a level of data normalization; however, we will keep a version of the raw data contributed for future analysis. We will analyze the CWE distribution of the datasets and potentially reclassify some CWEs to consolidate them into larger buckets. We will carefully document all normalization actions taken so it is clear what has been done. We plan to calculate likelihood following the model we developed in 2017 to determine incidence rate instead of frequency to rate how likely a given app may contain at least one instance of a CWE. This means we aren’t looking for the frequency rate (number of findings) in an app, rather, we are looking for the number of applications that had one or more instances of a CWE. We can calculate the incidence rate based on the total number of applications tested in the dataset compared to how many applications each CWE was found in. In addition, we will be developing base CWSS scores for the top 20-30 CWEs and include potential impact into the Top 10 weighting. Also, would like to explore additional insights that could be gleaned from the contributed dataset to see what else can be learned that could be of use to the security and development communities. |
Match the general defense methodology on the left with the appropriate description on the right
zusammenhängende Posts
Urheberrechte © © 2024 frojeostern Inc.
