CISSP-ISSMP Question #147: Real Exam Question with Answer & Explanation

Question

Which of the following statements is related with the second law of OPSEC?

Options

• AIf you are not protecting it (the critical and sensitive information), the adversary wins!
• BIf you don't know what to protect, how do you know you are protecting it?
• CIf you don't know about your security resources you could not protect your network.
• DIf you don't know the threat, how do you know what to protect?

Explanation

OPSEC is also known as operations security. It has three laws. The First Law of OPSEC. If you don't know the threat, how do you know what to protect? Although specific threats may vary from site to site or program to program. Employees must be aware of the actual and postulated threats. In any given situation, there is likely to be more than one adversary, although each may be interested in different information. The Second Law of OPSEC. If you don't know what to protect, how do you know you are protecting it? The "what" is the critical and sensitive, or target, information that adversaries require to meet their objectives. The Third Law of OPSEC. If you are not protecting it (the critical and sensitive information), the adversary wins! OPSEC vulnerability assessments, (referred to as "OPSEC assessments" - OA's - or sometimes as Surveys") are conducted to determine whether or not critical information is vulnerable to exploitation. An OA is a critical analysis of "what we do" and "how we do it" from the an adversary. Internal procedures and information sources are also reviewed to determine whether there is an inadvertent release of sensitive information. Answer option D is incorrect. The statement given in the option is not a valid law of OPSEC.

No community discussion yet for this question.