What is OPSEC?

In any research field where the focus of the study has to do with some form of threat, menace, or peril, the target of that analysis may turn on those that wish to understand, document, and analyze them. This is true for threat researchers and threat intelligence analysts, as well as those in the field of cyber security. In Chapter 2, Threat Actors, Campaigns, and Tooling, we spoke very briefly about how the threat actors behind Storm Worm began targeting organizations that were studying them, such as the SpamHaus project, and even began targeting the personal website of Joe Stewart, a security researcher from Secureworks, after he published research about the worm's capabilities. These limited examples are not one-offs or contained instances. There has been a long history of cyber threats where threat actors, threat actor groups, organized crime, and even nation states have focused their attention back on the security research community. Let's look at a few...