OPSEC (operational security)

In 1966, in the middle of the Vietnam War, US Pacific Command launched Operation Purple Dragon: the enemy seemed to know about certain operations in advance, and the investigation found it was inferring them from unclassified indicators and predictable routines, with no spy involved. The five-step OPSEC process came out of it (identify critical information, analyze the threat, analyze vulnerabilities, assess risk, apply countermeasures), and presidential directive NSDD-298 of January 1988 made it a national program. In civilian information security, the term covers the habits that keep an organization from handing an adversary usable information by accident: posting the dates of an incident response engagement on social media, publishing a screenshot that shows software versions or internal account names, leaving metadata in a published document. A job posting that lists the full tech stack briefs the attacker too. For a cyber underwriter, what a company says about itself in public is part of its exposed surface, alongside its internet-facing services. The term cuts the other way as well. Ross Ulbricht, the founder of Silk Road, was traced partly because the handle altoid, which had promoted the site on forums in early 2011, had also posted his personal Gmail address that same year. Threat intelligence lives on mistakes like that.