threat. If the recipe falls into the hands of a competitor or another company that operates in the same industry, then the company can easily take advantage of that.

Similarly, for a software company, the proprietary source code needs to be protected from unauthorized parties. If the proprietary source code gets exposed outside, that will be considered as a threat.

3. Analysis of vulnerabilities

In this step, one has to analyze the vulnerabilities associated with the assets that were identified in the first step of the operations security process. For example, for a software company, if the security controls on the proprietary source code are not proper or security policies are not proper, then an unauthorized party or an attacker can take advantage of that and access, modify or delete the source code. So, not having proper security controls or security policies will be considered as vulnerabilities that need to be addressed to protect the information.

4. Assessment of risks

As we discussed, when there is a threat and a matching vulnerability, there is a risk (What are threats, vulnerabilities, risks, and impact?). So, if the source code of a company is proprietary and there are not enough security controls or security policies, then there is a threat with matching vulnerabilities. And hence, there is a risk.

So, if the threats or vulnerabilities are not addressed, there is a considerable risk that the secret information that we want to protect may get exposed outside.

5. Application of countermeasures

In this step of the operations security process, the threats or vulnerabilities are mitigated by using proper countermeasures.

For example, for a software company, the proprietary source code getting exposed outside is a threat. But, we cannot do much to mitigate the threat. So, we need to take proper countermeasures to mitigate the vulnerabilities that can expose the source code outside.

Hence, the company should put proper security controls and security policies in place. For example, the company can take strong measures to control access to the source code and establish a set of rules to determine how to control access to the source code, etc.