<h1>Audit your OPSEC and determine the appropriate internet use</h1>
<p>In this tutorial we're going to explore how you can audit your own level of Operational Security (also known as opsec), using the following 6 parameters:<b>Complexity, Transparency, Surveillance, Centralisation, Onymity, and Deniability</b>. The goal is to determine the level of Privacy, Anonymity and Deniability of your operations online to determine what you can do safely.</p>
<imgsrc="0.1.png"class="imgRz">
<p> Based on those, we are able to determine <b>the most appropriate Internet use.</b></p>
<imgsrc="0.png"class="imgRz">
<p>Auditing your own OPSEC is an essential skill that you must possess, we're going to audit the 4 different setups below, to be able to determine where they fit. </p>
<p>To do so, we are going to simplify it down to 4 OPSEC levels: <b>Public, Private, Anonymous and Sensitive</b>.</p>
<imgsrc="0.4.png"class="imgRz">
<p><u>Sidenote:</u> If your setup is suitable only for public internet use, you CANNOT use it for any private use, and so on. </p>
</div>
</div><!-- /row -->
</div><!-- /container -->
</div><!-- /grey -->
<!-- +++++ Second Post +++++ -->
<divid="anon3">
<divclass="container">
<divclass="row">
<divclass="col-lg-8 col-lg-offset-2">
<h2><b>Bob's Setup: Public Internet Use </b></h2>
<imgsrc="1.png"class="imgRz">
<p><imgsrc="../co0.png"><u><b>Complexity:</b></u> Bob didn't put any effort. He bought his PC and windows was pre-installed, and he used it as it was.</p>
<p><imgsrc="../tr2.png"><u>Transparency:</u> Bob uses windows as a host OS, and google chrome as his web browser. Both are closed-source, he does not know what his software is doing.</p>
<p><imgsrc="../su2.png"><u>Surveillance:</u> Since bob uses closed-source software, he is under constant surveillance while using his computer.</p>
<p><imgsrc="../ce2.png"><u>Centralisation:</u> Bob uses popular services that are centralised in nature, he depends on the goodwill of others to use their services</p>
<p><imgsrc="../on2.png"><u>Onymity:</u> Because there is no privacy, anonymity is impossible for Bob.</p>
<p><imgsrc="../de2.png"><u>Deniability:</u> Bob cannot deny anything that he's doing on his computer, as he is under constant surveillance, without any possibility of anonymity.</p>
<p><u>Conclusion:</u><b>Bob's setup is suitable only for Public internet use</b>, as he is under constant surveillance while using it.</p>
</div>
</div><!-- /row -->
</div><!-- /container -->
</div><!-- /white -->
<divid="anon2">
<divclass="container">
<divclass="row">
<divclass="col-lg-8 col-lg-offset-2">
<h2><b>Alice's Setup: Private Internet Use</b></h2></br></br>
<imgsrc="2.png"class="imgRz">
<p><imgsrc="../co1.png"><u>Complexity:</u> Alice has put some effort to get her current setup, she is willing to go out of her comfort zone to improve her OPSEC.</p>
<p><imgsrc="../tr0.png"><u>Transparency:</u> Alice only uses open source software (Linux and Firefox) she can see from the sourcecode that it only does what it should do.</p>
<p><imgsrc="../su0.png"><u><b>Surveillance:</b></u> Alice has verified that the open source software that she was using wasn't spying on her</p>
<p><imgsrc="../ce1.png"><u>Centralisation:</u>Alice is starting to move away from centralised services, she's looking at other alternatives, but they are still centralised. </p>
<p><imgsrc="../on1.png"><u>Onymity:</u> Alice is exploring anonymity, but through a pseudonym online, she is not anonymous yet.</p>
<p><imgsrc="../de2.png"><u>Deniability:</u> Alice cannot deny that she has used her current setup </p>
<p><u>Conclusion:</u><b>Alice's setup is suitable for Private use</b>, as she managed to remove surveillance from her setup.</p>
</div>
</div><!-- /row -->
</div><!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ -->
<divid="anon1">
<divclass="container">
<divclass="row">
<divclass="col-lg-8 col-lg-offset-2">
<h2><b>Charlie's Setup: Anonymous Internet Use</b></h2></br></br>
<imgsrc="3.png"class="imgRz">
<p><imgsrc="../co2.png"><u>Complexity:</u> Charlie is willing to go at great lengths to improve his OPSEC</p>
<p><imgsrc="../tr0.png"><u>Transparency:</u> Charlie only uses open source software, that way he knows that the software he uses only does what he wants it to do.</p>
<p><imgsrc="../su0.png"><u>Surveillance:</u> Charlie has verified that the software he is using, is not surveilling what he's doing</p>
<p><imgsrc="../ce0.png"><u>Centralisation:</u> Charlie has moved away from centralised services, and is using their decentralised counterpart from the fediverse </p>
<p><imgsrc="../on0.png"><u><b>Onymity:</b></u> Charlie is anonymous online, thanks to it's use of the tor network through Whonix and tor browser</p>
<p><imgsrc="../de1.png"><u>Deniability:</u> Charlie, thanks to his use of anonymity technologies, may be able to deny that he has used this setup depending on the context. However if an adversary gets physical access to his computer, he won't be able to deny that he has ever used it.</p>
<p><u>Conclusion:</u><b>Charlie's setup is suitable for Anonymous use</b>, as he managed to implement anonymity technologies into his setup.</p>
</div>
</div><!-- /row -->
</div><!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ -->
<divid="anon2">
<divclass="container">
<divclass="row">
<divclass="col-lg-8 col-lg-offset-2">
<h2><b>Dave's Setup: Sensitive Internet Use </b></h2></br></br>
<imgsrc="4.png"class="imgRz">
<p><imgsrc="../co2.png"><u>Complexity:</u> Dave is willing to go at great lengths to improve his OPSEC</p>
<p><imgsrc="../tr0.png"><u>Transparency:</u> Dave only uses open source software, that way he knows that the software he uses only does what he wants it to do.</p>
<p><imgsrc="../su0.png"><u>Surveillance:</u> Dave has verified that the software he is using, is not surveilling what he's doing</p>
<p><imgsrc="../ce0.png"><u>Centralisation:</u> Dave has moved away from centralised services, and is using their decentralised counterpart from the fediverse </p>
<p><imgsrc="../on0.png"><u>Onymity:</u> Dave is anonymous online, thanks to it's use of the tor network through Whonix and tor browser</p>
<p><imgsrc="../de0.png"><u><b>Deniability:</b></u> Dave can deny that he has commited any anonymous activity, because the VM he uses is inside a veracrypt hidden volume, that he can deny the existance of. </p>
<p><u>Conclusion:</u><b>Dave's setup is suitable for Sensitive use</b>, as he managed to implement plausible deniability on top of anonymity technologies into his setup.</p>
</div>
</div><!-- /row -->
</div><!-- /container -->
</div><!-- /white -->
<divid="anon1">
<divclass="container">
<divclass="row">
<divclass="col-lg-8 col-lg-offset-2">
<h2><b>Recap of the 4 basic OPSEC levels</b></h2></br></br>
<imgsrc="0.3.png"class="imgRz">
<p>Now as you can see, the higher the opsec level, the more complexity one must be willing to bear with, in order to increase their own operational security.</p>
<p>Take the 6 parameters into account before trying to use a specific setup for an inappropriate internet usage. If you want to have all of those 4 setups at once, check out my tutorial on <ahref="../internetsegmentation/index.html">VM-based internet usage segmentation</a></p>
