22. January 2008 by Revelator.

In our world the OPSEC chaos theory describes the behavior of certain nonlinear dynamical risk analysis systems that may exhibit dynamics that are highly sensitive to initial conditions (popularly referred to as the butterfly effect). As a result of this sensitivity, which manifests itself as an exponential growth of perturbations in the initial risk conditions, the behavior of chaotic OPSEC systems appears to be random. This happens even though these systems are deterministic, meaning that their future dynamics are fully defined by their initial vulnerability conditions, with no random elements involved. This behavior is known as deterministic OPSEC chaos, or simply OPSEC chaos.

Chaotic behavior has been observed in the laboratory in a variety of systems including intelligence collection, oscillating chemical reactions, logistical black holes, administrative SNAFU’s, fluid dynamics, operations planning, and mechanical/magneto-mechanical devices. Observations of chaotic OPSEC behavior on the battlefield include the dynamics of unencrypted satellite comms in the solar system, the time evolution of the magnetic field of adversarial bodies, radical population growth in ecology, the dynamics of the threat potentials in neurons, and molecular vibrations. Everyday examples of chaotic OPSEC conditions include the OPSEC Coordinators meeting, the OPSEC Staff Assistance Meeting, and the “Sprinkle some OPSEC on this plan” verbal order.

Systems that exhibit mathematical OPSEC chaos are deterministic and thus orderly in some sense; this technical use of the term OPSEC chaos is at odds with common parlance, which suggests complete disorder. A related field of physics called quantum OPSEC chaos theory studies systems that follow the laws of quantum risk mechanics. Recently, another field, called relativistic vulnerability chaos, has emerged to describe systems that follow the laws of general vulnerability relativity.

As well as being orderly in the sense of being deterministic, chaotic OPSEC systems usually have ill defined statistics. And this is why no one will protect items on your Critical Information List, everyone will say exactly what they aren’t supposed to say when out on the town and everyone will whine when you mention that it is time for their OPSEC brief. OPSEC Chaos – ain’t it a bitch.

Keep the Faith!

Revelator

Posted in BS | Print | 1 Comment »

22. January 2008 by Revelator.

Folks, it’s all OPSEC. I just couldn’t resist a quote from an old co-worker of mine. Our friend and frequent contributor Kirk Dunaway has some great guidance for you here. Having sat next to Kirk for over two years I can tell you that I personally have averted many a disaster by taking his advice. Read and heed!

Tips from a guy who has been asked to look at a lot of peoples computer problems…

OPSEC? Well, ish. I can throw words like vulnerability, intent, survey and OPSEC measures at this, to justify the fact that I am submitting something on the fringe of OPSEC to this blog, but I just thought I would pass along some free advice.

1. Cannot stress the importance of anti-virus software. There are many offered, at various costs (from free to $$$), just make sure you have it on there. The major differences are some offer better protection but are slower, some are faster but protect less and some fall in the middle. My advice is to stay with recognizable name brands if you are not sure.

2. Firewalls really do work! A computer, by default, listens and accepts all kinds of traffic, regardless whether you are using that type of traffic or not. Bad guys use these typically unused traffic types to attack your system. A firewall shuts down that vulnerability. Of course, there is some pain at first (yes, let me check my email, and remember!!! Yes, please, I want to access the internet!!!), but once set up it is relatively invisible. The protection it provides is very valuable. There are hardware firewalls, but I still recommend loading a software firewall on your system (free or $$$).

3. There are adware identifying software programs available, if you are concerned with someone tracking your surfing habits. Load up and scan away.

4. Currency is huge. Anti-virus, operating system, firewall, etc, are of little use against the latest badware if your system software is not up to date. By all means set up whatever you can to automatically update. If you do not automatically update, at least manually update once a week. If you do automatically update, perform a manual update once a month to make sure automatic update picks up everything.

5. Spend a few bucks, buy an external USB hard drive at least as large as your computer hard drive, and copy off important stuff once a month. You can export your browser favorites and email contacts (and emails, if you know where to look), then copy everything over manually. Or you can buy backup software to do it all for you. But regardless, bad viruses do disable computers, and hard drives fail, so keep that 2nd copy in case you have to start over.

6. Put an entry in your email contact list that contains your own email address. Like “ZZZZME”, so it can be ignored at the end. But then if you are infected, and some virus is sending itself out using the contact list in your email, you will know.

7. Turn off your computer when not in use. Most bad guys know we do not use our computers at night, so that’s when they use them. Shut it down, and reduce your window of vulnerability.

8. If you think you have been infected, and you have current virus software, shut down your system. Disable your network connection (unplug or turn off wireless access point). Now power up, and keep pressing the “F8” key while booting up. This will eventually give you a boot menu. Select “Safe Mode”, and when it comes up run a thorough virus scan. Your virus software should be able to clean any bad stuff in Safe Mode. If not, call in the cavalry.

9. If you think you have been infected, and you do not have current virus software, try an online virus scanner (like the free one from TrendMicro) to see if you can repair it.

Anyway, these tips could save you from a couple hundred bucks getting your computer cleaned to losing your hard drive (and how many years worth of digital pictures?). Oh yea, critical information, risk, and threats.

Kirk out.

Posted in WWW | Print | No Comments »

22. January 2008 by Revelator.

This will be the day when all of God’s children will be able to sing with a new meaning, “My country, ’tis of thee, sweet land of liberty, of thee I sing. Land where my fathers died, land of the pilgrim’s pride, from every mountainside, let freedom ring.”

And if America is to be a great nation this must become true. So let freedom ring from the prodigious hilltops of New Hampshire. Let freedom ring from the mighty mountains of New York. Let freedom ring from the heightening Alleghenies of Pennsylvania!

Let freedom ring from the snowcapped Rockies of Colorado!

Let freedom ring from the curvaceous slopes of California!

But not only that; let freedom ring from Stone Mountain of Georgia!

Let freedom ring from Lookout Mountain of Tennessee!

Let freedom ring from every hill and molehill of Mississippi. From every mountainside, let freedom ring.

And when this happens, when we allow freedom to ring, when we let it ring from every village and every hamlet, from every state and every city, we will be able to speed up that day when all of God’s children, black men and white men, Jews and Gentiles, Protestants and Catholics, will be able to join hands and sing in the words of the old Negro spiritual, “Free at last! free at last! thank God Almighty, we are free at last!”

Martin Luther King, Jr.

August 28, 1963

Keep the Faith!

Revelator

Posted in Uncategorized | Print | 1 Comment »

18. January 2008 by Revelator.

Fellow OPSECers, time has come for another computer related guest entry from our most prolific guest writer and good friend Kirk Dunaway.  Enjoy…

Computer down again? Might as well go home for the day. We’ve come to a point in our rapidly evolving world where no one can accomplish anything without email and internet access.  But when your computer is up and running and you’re toiling away, how much OPSEC-sense do you actually apply to your work habits?

OK, first the basics; you should know by now that the only secure computer is one that is not connected to ANYTHING! Once you have email and internet access - all bets are off. Sure, folks get paid to harden you system - to introduce a level of pain to the bad guys knocking on the door.  And they’re usually successful in keeping out 95% of the boneheads out there.  But those same boneheads know something you probably don’t think about; why attack you at your desktop, when they can just see what you do when your traffic enters the ‘net?

Think folks don’t pay attention?  Wow, you really DO need to read this blog more often!  Just think of the “cookie wars” raging on the ‘net.  Advertisers track where you go and what you look at, so they can place targeted ads on sites you visit.  Whether that’s good or bad is up to you, but personally I’d rather look at an ad for a computer company than for women’s clothing.  But the point is that if it is easy enough for advertisers to do it, think how easy it is for the bad guys.  And they track using more than just cookies.  It’s easy for them to sit passively by and just watch the traffic flow - seeing what comes and seeing what goes.  And there you are sitting at your desk in the Pentagon surfing sites that specialize in cold weather gear…in July.  Indicator?

The point is that traffic is in fact watched.  And if the watchers can put together the sites that everyone in your unit is surfing to, plus read all the un-encrypted emails, then there’s a good chance you’ve given them a costly glimpse into your future.  On the other hand, odds are good that no one is scrutinizing your computer at home.  If you think and apply OPSEC at work maybe, just maybe you’ll decide to surf the iffy sites from home.

Side note:  Concerned with cookies, pop ups, and other bad stuff that could be on an internet site?  Try downloading and using Opera, Safari, Netscape Mozilla FireFox or some other browser.  MS Internet Explorer, as the most popular, is the most targeted.  Also, the other browsers (such as FireFox)  do a better job of cleaning up your tracks once you exit.

Surf clean bruddah,

Kirk out.

Posted in WWW | Print | No Comments »

16. January 2008 by Revelator.

Fellow OPSECers - it is time.

According to my counter hundreds of you are coming to this blog on a regular basis and The Godfather and I thank you.  But while many of us come to this blog and many others of us go to the OSPA, OPS or IOSS web sites rarely are we together as one.   At any given time tens of us may actually be on one of these sites at exactly the same time but so what?  Does that mean we are united as a community?  I think not.  But you’re thinking; what about the National Conference?  Or the Western or Eastern Forums?  We’re united as a community then aren’t we?  Absolutely.  But add these events together and the reality is that, at best, we spend less than two weeks together all year.  And that is only true for the 12 of you who actually attend all three events!  And that is truly sad.  I’m not kidding here folks.

Though we are doing what we can the OPSEC Community remains a very small community indeed.  When we actually do come together one of the many complaints I hear is that we need to get together more - not literally necessarily, but figuratively and even virtually.  I’ve heard many varied suggestions about how this can be accomplished but to me the simplest (and most often recommended) way for us to come together is electronically.   And while I’m sure some of you have mad Halo and Gears Of War skillz I think we would be better off coming together during an OSPA hosted chat session.

So; you asked for it - you got it.  Now the big question is: Will anyone show up?  I gotta be honest with ya - the over/under for chat participants is currently hovering around 12 on Las Vegas betting lines.  Some members have suggested that the number of participants should determine if we host further sessions.  Let me be a voice of disagreement on this point.  I believe that OSPA leadership needs to remain immediately responsive to the needs of our members even if those in need number in the single digits.  Just as a heads up - if a member contacts anyone in the OSPA leadership we virtually guarantee to personally call or meet you in our chat room on that very day.  We have a perfect record so far and aim to keep it that way.

And finally - just what is this chat going to be about?  While many OPSEC-related topics desperately need deep discussion we are going to start with a simple question: What can OSPA do for you?  No further prompting or specific topic pimping.

What can OSPA do for you?  Think about it.  I’ll see you in our chat room on Wednesday, 23 January from 7pm till (at least) 9pm right coast time.  More details to follow.  If you have any questions feel free to contact any of your OSPA leadership of leave your question here on this blog.

Keep the Faith!

Revelator

Posted in OSPA | Print | No Comments »

7. January 2008 by Revelator.

If it’s computer related then it must be guest blogger Kirk Dunaway again.  Enjoy…

OK, so you fire up the computer, crank up the email - and here they come.  The 37 forwarded emails from your friends.  I know…some of these are actually pretty cool.  Some are actually pretty good jokes or an unbelievable video.  You know the one - the one you just have to show your buddies!  But then there are the “warm fuzzy” or “blessings” or “cutsie” emails that always end with “for good luck (or blessings), pass this on to 10 friends.” Or the ever popular “send this to 10 people and see what great things happen in your life!”  Or how about the “don’t break the chain and receive bad luck!  Send to 10 people and then back to the sender” emails.  And then for no reason whatsoever…you do!

So now, without even raising your right hand you have enlisted in the army of a spammer.  Estimates place spam as high as 70% of emails entering corporate email servers.  The majority of these are inert ads, but not all.  How safe are those emails you pass on?  Spam emails can (and do!) contain embedded malware.  Do you actually think everyone’s anti-virus software is current, or even looks for the newest mutations?  Would you be willing to wager money on that?

The spam emails sent by strangers to you typically do not work well on you.  Most folks (fortunately) just delete them unread.  But get one from your bud and you’ve just got to see what he sent!  The last joke he sent you was awesome!  Oh, but this time it is a sickly sweet poem; with Papal blessings no less.  And you’re thinking “Nice; thanks bud.  Wait.  I know - I’ll pass this on to my friends from church.”  Well, lo and behold, in a couple of days your virus software performs its automatic update and what is that?  A virus alert?!  Oh man; now you have a virus.  Where did that come from?  And then come Sunday you find that a lot of your friends from church have the same virus and they’re greeting you not with blessings on their breath but accusations in their eyes.  

The solution is so simple.  Resist the urge!  Don’t forward it - just delete it.  These things only work with our ignorant facilitation.

Side Note:  Get a spam ad from someone you don’t know?  Does is have an “unsubscribe” link?  DONT CLICK IT.  Simply block the sender in your email program and delete the original email.  Spam gets generated and sent to random strings of email addresses and by “unsubscribing”  you have not only verified a good address, you just placed yourself on a couple of hundred spam lists.  Of course, if you actually signed up on a web site with a company you know and trust and provided them with your email address and they are hitting you with too many ads then, by all means, use the “unsubscribe” link with confidence.

Other Side Note:  The best address to give out online is a disposable one.  Make a Yahoo or GMail or Hotmail or whomever account online and then use that for online business.  Leave your home based personal address just that; give it only to friends and family.  Once the online disposable account starts getting too much spam (and you know it will), just abandon it and make a new one.  Then change your email at the businesses you still deal with.  Life is so much better without 257 new useless emails every day (enlarge my WHAT?!?)

Aloha - Kirk out

Posted in WWW | Print | 4 Comments »

3. January 2008 by Revelator.

I know, I know…I only used one exclamation point.  This isn’t to imply that I don’t wish y’all a great year - I just think that a single exclamation point should convey the point.  I’m getting tired of extra punctuation.  Would extra exclamation points make you feel like I wished you a better year than one does?  Would two or three question marks after that question make it more of a question?  But I digress…

As an OPSECer I am constantly on the look out for indicators of things to come - of actions that are likely to happen based on what has already happened - and one thing I can tell you based on my observations is that 2008 is going to be a great year to be a member of OSPA!  (See?  One works just fine.)   It truly is hard for me to fathom how far the OSPA has come from it’s very humble roots less that one year ago.  I sincerely hope that at this time next year I am humbled by what has transpired in 2008. 

So just what is coming for 2008?  First up on the calendar I see the IOSS/OSPA co-sponsored Western OPSEC Forum in February.  I know many OSPA members have already registered and I look forward to meeting y’all there.  Nothing is firm yet but I know that many of the OSPA Board of Directors will be in attendance and that we plan on having an informal OSPA member get together some time during the three-day event.  Check out www.IOSS.gov for more information.

Right along those same lines the National OPSEC Conference in April is fast approaching and I just can’t wait.  I’ve seen the agenda and can tell you that the IOSS has put together a damn fine list of presenters for this year (including yours truly and many of your OSPA Board).  I’m told this agenda will be on our OSPA site some time today so check it out when you get a minute.  On top of this, we are planning a monster OSPA coming-out party on Tuesday evening of the National Conference!  For your meet and greet enjoyment we have hooked up personal appearances by many OPSEC-world celebrities and dignitaries.  Anchoring the event will be Wayne Morris (OSPA, Exec VP) and I sharing hosting duties as we present the “Wayne and Layne Super-Fun-Time-Happy-Hour Hot Tub Celebrity-Ho-Down Monster Truck Rally.”   No one - including Wayne and myself - has a full understanding what that means but I can tell you that it will be interactive, entertaining, and most of all - fun. 

 THE OSPA OPSEC ACADEMY.  Yeah, I put that in caps on purpose.  It deserves it.  While still on the drawing board it is my humble opinion that the Academy as the most significant contribution OSPA will make to the OPSEC community.  As our motto states we are a member-driven association and while your needs are many this is what you, the member, has told us you need them most.  Input has been received from you and we are currently working on completing the module listing.  Many more very exciting things are in the works but at this time I will leave any further comment to our Academy President, Mr. Tom Mauriello who has promised to update y’all right here in this very blog in the near future.

Also during two double-ought eight we will establish our new logo.  No, we’re not going to have a five-hour Board meeting and decide this for you.  As fun as that sounds, we need your input.   Our founder and Prez Chris Cox will very soon send you the guidelines for the logo contest.  Enter early and enter often.  I can’t wait to see what you come up with!

While I think we’ve done a pretty fine job with the OSPA web site we will be constantly looking for more OPSEC related content to share with our members during 2008.  To that end please send us anything you think others in the OPSEC community might be able to use.  Personally, I like the comics, jokes and video’s you’ve sent us so far but keep it ALL coming.  The more we share the more we grow as a community.  While OPSEC is concerned with protecting all our sensitive information the OSPA is concerned with sharing all the non-sensitive information we can get our hands on with you, the member.  There’s no I in OSPA people!  Wow; that was trite, hackneyed and just plain worn out - I’ll try to avoid this in the future…

Speaking of the future… So many more exciting things are happening in OSPA that I want to just keep on telling you all about it but I think I’ll stop for now.  If you have any questions please feel free to contact any one of the OSPA Board members at any time.

I’ll leave you now with a quote that will make no sense to you now but will be explained at the National Conference:  “Yet, when we can entreat an hour to serve, we would spend it in some words upon that business, and ask thee is Jenn the titter?”  And with that I bid you fare-thee-well…

Keep the Faith!

Revelator

Posted in OSPA | Print | No Comments »