Congratulations! You finally finished. Six months ago you made it through the OPSEC course. Sure, you had an unrequited love for your instructor but so did the other 17 dudes in your class - get over it. Back in the real world you found that you had purple blood flowing through your veins and you headed back to work ready to kick some OPSEC ass. The spirit of the legendary Purple Dragon burned in your heart and soul and you began grinding your way through the five-step process. You were a BEAST! A big, fire breathing beast on an OPSEC bender.
You developed your new and improved Critical Information List like a crazed maniac who just discovered that mixing Monster Energy with a Red Bull and two diet pills will keep you rocking and/or rolling all night long…and then all day…and then all night long again. Your threat research was focused and spot on and you knew exactly what threats were targeting your sensitive information.
Vulnerabilities? Indicators? They didn’t stand a chance against a highly motivated OPSEC professional such as yourself. No freaking way! So you rolled on like the man-beast you are - ready for anything and everything.
Risk? You don’t need no stinking risk! You’re prioritizing risk better than David Lee Roth’s groupie-hunting roadie and you started to think someday you could actually get that OPSEC Certified Professional certification bestowed upon you as your beautiful wife looks on with love in her eyes. Finally, you developed and institutionalized your countermeasures and you just knew the effectiveness of your new OPSEC program would certainly earn you the Individual Achievement Award at next years National OPSEC Conference. You even searched on-line for hotels and flights to San Antonio. Ahhhhhhh, the warm feeling of a job well done. Sit back my friend - it’s Miller time.
On the other hand (typically a backhand with a big ring on it) there is one thing you’ve missed. One thing that is so critical to an OPSEC program that if left undone will render all your hard work worthless and you can kiss your coveted award goodbye. Brothers and sisters I’m talking about feedback. Think about it - without feedback how will you ever know if your carefully crafted countermeasures are working? How will you ever know if your education and training is having any effect? How will you know if your new visitor controls are working?
A lack of feedback, in any endeavor, equals a lack of success. Let’s take dating for example. If you’re not paying attention to feedback on a first date, chances are you’ll never see a second date. Whether you notice or not you’ll be receiving feedback all night long. Some positive and some negative. But even the negative feedback helps, doesn’t it? If you’re paying attention you will learn real quick what dating measures and countermeasures are or aren’t working and you’ll be able to adjust accordingly. Ignoring, or not seeking out, feedback can kill your program.
Have you seen people who ignore feedback? I know you have. Ever worked for that one guy or gal who just won’t shut the hell up? You know the kind - the one that’s still yammering on even after you’ve wandered away and are strolling down the hall? And ladies, I know you’ve been out in the social environment and there’s always that one guy who just won’t give up. He’s trying to chat you up, or buy you a drink, or get you to dance and instead of getting your subtle hints he just thinks your playing hard to get and doesn’t realize that you don’t think his never-say-die attitude is all that charming and as a matter of fact if he says one more annoying word to you he’s gonna end up wearing that Appletini you’ve been nursing.
All I’m trying to say is that you need to establish some feedback mechanisms for your OPSEC program. You simply cannot succeed working in the blind. You need to find out how, or even if, your OPSEC message is getting across. You need to check to see if your countermeasures are working as designed. Is the information you determined sensitive or critical being protected in the manner you desire?
Be the beast! One of the best feedback mechanisms you can employ is to get out there in the gen-pop and talk to people in your organization. Get the feedback you need and adjust your program accordingly so that your program at least has an outside chance to succeed. And guys, next time you’re out there searching for Mrs. Right or Ms. Right Now - keep your eyes and ears open. You just might learn something.
Keep the Faith!
Revelator