The operations security process can be distilled into three rules. These rules are an important part of the operations security process, and they are called the laws of operations security. The laws of operations security are the most important aspects of the operations security process. These three laws of operations security are:

First Law: Know the threats

One needs to know the threats in order to protect critical information. If one does not know the threats, how is one going to protect critical information from the threats?

For example, if a company makes soft drinks, then the secret recipe of the soft drink is critical information. And, the secret recipe getting exposed outside is the threat. If the secret recipe gets exposed outside and falls into the hands of competitors or any company that conducts business in that industry, then the adversary can easily take advantage of that. Hence, one needs to know the threats in order to protect information from the threats.

Second Law: Know what to protect

As per the second law, one needs to identify the critical information that needs to be protected from threats. If one does not know what to protect, how is one going to protect it?

For example, for a software company, the proprietary source code of the software is critical information. If the source code falls into the hands of a competitor or any other adversary, the adversary can easily take advantage of that. Hence, a software company should take all security measures to protect the proprietary source code from getting exposed outside.

Third Law: Protect the information

If one does not protect critical information, then the adversary wins. The third law gives importance to the operations security process overall. One needs to take proper security measures to protect critical information from adversaries.

For example, a software company should take all security measures to protect the source code from getting exposed outside. The company should put proper security controls and security policies in place and take proper security measures to control access to the source code.