#OPSEC365 024/365

Every Word document and PDF you create embeds your name, your computer's name, edit history, and sometimes the file path showing your folder structure.

Before you send a document to someone you don't fully trust, that metadata tells them more about you than the content does.

Right-click a document you've shared recently, check Properties or Get Info, and see what's embedded.

Virtualization security and hypervisor isolation mechanisms.

"Virtual machine monitors must provide strong isolation between guest operating systems."

- 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗠𝗲𝗰𝗵𝗮𝗻𝗶𝘀𝗺𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗩𝗠/𝟯𝟳𝟬 𝗛𝘆𝗽𝗲𝗿𝘃𝗶𝘀𝗼𝗿 by R.J. Creasy (1981)
https://dl.acm.org/doi/10.1145/800217.806615

#OPSEC365 023/365

In 2018, Strava's global heatmap revealed the locations and layouts of secret military bases because soldiers were tracking their runs.

Fitness apps broadcast where you exercise, what routes you take, and what time you're usually there. If your profile is public, anyone can see your patterns.

Strava's default is public. Soldiers exposed military base layouts in 2018 because nobody changed it. Set your fitness profiles to private.

#OPSEC365 022/365

JP 3-13.3 OPSEC doctrine defines a Critical Information List — data whose disclosure degrades operational security. Your home has one too.

Every smart speaker expands that CIL to a corporate entity you never vetted. Bedroom. Home office. Kitchen. Each room is a compartment. Each speaker collapses it.

Hoepman's SEPARATE strategy: isolate actors from their data proxies. The fix is removing the device from sensitive contexts entirely.