ExamRange – CND 312-38 Simulation

In this module, you will learn to apply the Operations Security (OPSEC) process to a network deployment. You will evaluate how planned network operations might leak critical information to adversaries before applying defensive controls.

Network Scenario

Your organization is preparing to deploy a new Centralized Log Management and SIEM infrastructure. The deployment is currently in the planning and staging phase.

The security team has already identified that the SIEM architecture, IP schemes, and staging domain names are Critical Information (Step 1). They have also established that the primary threat is an Advanced Persistent Threat (APT) group known to monitor public OSINT sources to map out target infrastructure (Step 2: Analysis of Threats).

As a Network Defender, you are reviewing the deployment plan to identify any observable indicators that might leak out, and matching them against the APT's known passive reconnaissance capabilities.

Traffic & Logs

Deployment Plan Review - OPSEC Evaluation Phase

[09:00:15] [INFO] REVIEW ITEM: SSL/TLS Certificate Procurement. [09:00:17] [INFO] Action: IT will request a public Let's Encrypt cert for "siem-staging.internal.corp.com" [09:02:40] [WARN] OPSEC INDICATOR IDENTIFIED: Public Certificate Transparency (CT) Log Entry. [09:05:12] [WARN] CAPABILITY MATCH: Threat Actor "APT-X" utilizes automated CT log scraping to identify new subdomains. [09:10:00] [ALERT] Vulnerability Found: The planned certificate request provides actionable intelligence to the adversary.

Question

Which of the following steps of the OPSEC process examines each aspect of the planned operation to identify OPSEC indicators that could reveal critical information and then compare those indicators with the adversary's intelligence collection capabilities identified in the previous action?

Hint: The 5-step OPSEC process is: 1) Identify Critical Information, 2) Analyze Threats, 3) Analyze ______, 4) Assess Risk, 5) Apply Measures. Which step evaluates the weaknesses or "holes" where our indicators match the enemy's collection tools?

Expert Analysis

1. What is happening in the network

The network team is planning a deployment and intends to request a public SSL certificate for an internal staging server. The OPSEC review flagged this action because public certificates are logged in Certificate Transparency (CT) logs, which are observable by anyone on the internet.

2. Identify behavior

The defender is proactively evaluating the deployment plan to find OPSEC indicators (the CT log entry) and comparing them against the adversary's capabilities (automated CT log scraping).

3. Why the correct answer is correct

Analysis of Vulnerabilities is the 3rd step of the OPSEC process. A vulnerability exists when the adversary is capable of collecting an OPSEC indicator, analyzing it, and using it against you. This step strictly involves matching your exposed indicators with their collection capabilities.

4. Why others are wrong

Identification of Critical Information (Step 1) defines what needs protecting. Analysis of Threats (Step 2) identifies the adversary and their general intent. Assessment of Risk (Step 4) calculates the impact and probability of the vulnerability being exploited. Application of Appropriate OPSEC Measures (Step 5) is when you actually fix the issue.

5. Defensive action

Because this vulnerability was discovered during planning, the defensive action (Step 5) would be to use an internal private Certificate Authority (CA) or a wildcard certificate (*.corp.com) so the specific "siem-staging" hostname is never leaked to public CT logs.

6. MINI LESSON: The OPSEC Process in Network Defense

Step 1: Identify Critical Information (What do we have that the attacker wants?)
Step 2: Analysis of Threats (Who is attacking us and what tools do they use?)
Step 3: Analysis of Vulnerabilities (Are we leaking indicators that their tools can detect?)
Step 4: Assessment of Risk (If they detect our leak, how much damage will it cause?)
Step 5: Apply OPSEC Measures (How do we change our behavior/network to stop the leak?)

CND (312-38) Network Defense Simulation