OPSEC methodology holds that understanding the adversary's threat and intelligence-gathering capability must come first, because it determines what information is actually critical/sensitive and needs protecting. This ordering — threat identification before asset/critical-information identification — is expressed as the first of the traditional three 'laws of OPSEC' used in operations security awareness training: 'If you don't know the threat, how do you know what to protect?' The second law then addresses identifying what to protect, and the third addresses the consequence of failing to protect it.
Community Discussion