FM-R1: FM-R1: Secure Communication Networks for Decentralized Resistance
UNCLASSIFIED
Section 2-1 to 2-4

Chapter 2: Threat Assessment and Operational Environment

Chapter Overview

This chapter provides systematic methodologies for understanding and responding to threats in resistance operations. Effective threat assessment is the foundation of all security planning, enabling resistance practitioners to allocate resources appropriately and design countermeasures that address actual rather than imagined risks.

Sections in this chapter:

Section 2-1: Understanding Your Adversary

Definition

Adversary analysis is the systematic study of hostile forces to understand their capabilities, motivations, limitations, and likely courses of action. In resistance operations, this analysis must encompass both state and non-state actors who pose threats to operational security and participant safety.

Adversary Categories

State Security Services

Capabilities:

Motivations:

Limitations:

Law Enforcement Agencies

Capabilities:

Motivations:

Limitations:

Private Intelligence Contractors

Capabilities:

Motivations:

Limitations:

Hostile Political Organizations

Capabilities:

Motivations:

Limitations:

Capability Assessment Framework

Technical Capabilities

Assessment Matrix:
1. Surveillance Infrastructure
   - Mass data collection capabilities
   - Real-time monitoring systems
   - Data analysis and correlation tools
   - International cooperation agreements

2. Cyber Operations
   - Offensive cyber capabilities
   - Defensive monitoring systems
   - Technical expertise and resources
   - Legal authorities and constraints

3. Human Intelligence
   - Informant recruitment and management
   - Infiltration capabilities
   - Social engineering expertise
   - Community presence and influence

Operational Capabilities

Intelligence Capabilities

Motivation Analysis

Primary Motivations

Understanding what drives adversary actions helps predict their behavior and identify potential vulnerabilities:

Institutional Interests:

Individual Motivations:

Political Factors:

Limitation Assessment

Resource Constraints

Operational Constraints

Intelligence Gathering

Adversary analysis requires ongoing intelligence collection through open sources, operational observation, and network reporting. This information must be systematically collected, analyzed, and updated to maintain accuracy and relevance.

Section 2-2: Threat Model Development

Definition

A threat model is a structured representation of potential threats to an organization, operation, or individual, including the assets being protected, potential attackers, attack vectors, and consequences of successful attacks. Threat modeling provides the analytical foundation for security planning and resource allocation.

Threat Modeling Process

Step 1: Asset Identification

Information Assets:

Physical Assets:

Operational Assets:

Step 2: Threat Actor Identification

For each asset category, identify potential threat actors:

Threat Actor Analysis Template:
Actor: [Name/Type]
Motivation: [Why they would target this asset]
Capability: [What they can do to compromise it]
Opportunity: [When/how they could act]
Impact: [Consequences of successful attack]
Likelihood: [Probability assessment]

Step 3: Attack Vector Analysis

Technical Attack Vectors:

Human Attack Vectors:

Physical Attack Vectors:

Step 4: Impact Assessment

Immediate Impacts:

Long-term Impacts:

Threat Modeling Methodologies

STRIDE Framework

Spoofing: Impersonating legitimate users or systems Tampering: Modifying data or systems without authorization Repudiation: Denying actions or transactions Information Disclosure: Exposing sensitive information Denial of Service: Preventing legitimate access to resources Elevation of Privilege: Gaining unauthorized access or permissions

PASTA (Process for Attack Simulation and Threat Analysis)

  1. Define Objectives: Establish scope and goals
  2. Define Technical Scope: Identify systems and components
  3. Application Decomposition: Break down into components
  4. Threat Analysis: Identify potential threats
  5. Weakness and Vulnerability Analysis: Find security gaps
  6. Attack Modeling: Simulate attack scenarios
  7. Risk and Impact Analysis: Assess consequences

OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation)

Threat Scenario Development

Scenario Template

Threat Scenario: [Descriptive Name]

Background:
- Current operational context
- Recent events and triggers
- Adversary capabilities and motivations

Attack Sequence:
1. Initial access or opportunity
2. Escalation and exploitation
3. Impact and consequences
4. Potential responses and countermeasures

Indicators:
- Early warning signs
- Detection opportunities
- Confirmation methods

Mitigation:
- Preventive measures
- Response procedures
- Recovery plans

Example Scenarios

Scenario 1: Communication Compromise

Scenario 2: Infiltration Operation

Scenario 3: Technical Surveillance

Scenario Planning

Threat scenarios should be realistic and based on actual adversary capabilities and historical precedents. Avoid both underestimating threats (leading to inadequate security) and overestimating them (leading to paralysis and ineffective operations).

Section 2-3: Risk Assessment Framework

Definition

Risk assessment is the systematic evaluation of potential threats to determine their likelihood and impact, enabling informed decisions about security investments and operational procedures. Risk assessment translates threat models into actionable priorities for security planning.

Risk Calculation Methodology

Basic Risk Formula

Risk = Threat × Vulnerability × Impact

Where:
- Threat = Likelihood of attack occurring
- Vulnerability = Probability of attack succeeding
- Impact = Consequences of successful attack

Qualitative Risk Assessment

Likelihood Scale:

Impact Scale:

Risk Matrix:

Impact →    VL  L   M   H   C
Likelihood ↓
Very High   M   H   H   C   C
High        L   M   H   H   C
Medium      L   L   M   H   H
Low         VL  L   L   M   H
Very Low    VL  VL  L   L   M

Legend: VL=Very Low, L=Low, M=Medium, H=High, C=Critical

Risk Assessment Process

Step 1: Threat Inventory

Create comprehensive list of identified threats from threat modeling process:

Step 2: Vulnerability Assessment

For each threat, assess organizational vulnerabilities:

Technical Vulnerabilities:

Procedural Vulnerabilities:

Human Vulnerabilities:

Step 3: Impact Analysis

Assess potential consequences of successful attacks:

Operational Impact:

Security Impact:

Strategic Impact:

Step 4: Risk Prioritization

Rank risks based on calculated scores and strategic importance:

Priority Categories:

Risk Treatment Strategies

Risk Mitigation

Reduce likelihood or impact through security controls:

Risk Transfer

Shift risk to other parties or systems:

Risk Acceptance

Consciously accept certain risks:

Risk Avoidance

Eliminate risk by avoiding the activity:

Risk Management

Effective risk management is an ongoing process that requires regular review and updates. Risk assessments should be updated whenever significant changes occur in the threat environment, organizational capabilities, or operational requirements.

Section 2-4: Operational Security (OpSec) Fundamentals

Definition

Operational Security (OpSec) is the process of protecting critical information and activities from adversary intelligence collection and analysis. OpSec focuses on identifying and controlling information that could be used to compromise operations, rather than just protecting classified information.

OpSec Process

Step 1: Identify Critical Information

Critical Information Categories:

Critical Information Examples:

Personnel Information:
- Real names and personal details
- Communication addresses and identifiers
- Role assignments and responsibilities
- Skill sets and expertise areas
- Personal vulnerabilities and pressure points

Operational Information:
- Mission objectives and success criteria
- Operational timelines and milestones
- Resource requirements and allocations
- Coordination mechanisms and protocols
- Contingency plans and alternatives

Technical Information:
- Communication methods and frequencies
- Security procedures and protocols
- Equipment specifications and capabilities
- Software configurations and vulnerabilities
- Network architecture and access points

Step 2: Analyze Threats

Apply threat modeling to identify how adversaries might collect and use critical information:

Collection Methods:

Analysis Capabilities:

Step 3: Analyze Vulnerabilities

Identify how critical information might be exposed:

Information Leakage Points:

Vulnerability Assessment Questions:

For each piece of critical information:
1. Who has access to this information?
2. How is this information stored and transmitted?
3. What activities might reveal this information?
4. What patterns might indicate this information?
5. How could an adversary collect this information?
6. What would an adversary do with this information?

Step 4: Assess Risk

Evaluate the likelihood and impact of information compromise:

Risk Factors:

Step 5: Apply Countermeasures

Implement measures to protect critical information:

Information Control Measures:

Activity Control Measures:

OpSec Planning

OpSec Plan Template

1. Mission Overview
   - Objectives and scope
   - Timeline and milestones
   - Success criteria

2. Critical Information List
   - Information categories
   - Sensitivity levels
   - Access requirements

3. Threat Assessment
   - Adversary capabilities
   - Collection methods
   - Analysis capabilities

4. Vulnerability Analysis
   - Exposure points
   - Risk factors
   - Mitigation priorities

5. Countermeasure Plan
   - Protective measures
   - Implementation timeline
   - Responsibility assignments

6. Monitoring and Review
   - Effectiveness metrics
   - Review schedule
   - Update procedures

Implementation Guidelines

Training and Awareness:

Monitoring and Enforcement:

Integration with Operations:

OpSec Discipline

OpSec is only as strong as its weakest link. All participants must understand and consistently apply OpSec principles. A single careless action can compromise an entire operation and endanger all participants.

Chapter Summary

Chapter 2 has provided the analytical framework necessary for understanding and responding to threats in resistance operations:

Section 2-1 established methodologies for analyzing adversary capabilities, motivations, and limitations across different threat actor categories.

Section 2-2 introduced systematic threat modeling approaches for identifying and analyzing potential attacks against resistance operations.

Section 2-3 provided risk assessment frameworks for prioritizing threats and allocating security resources effectively.

Section 2-4 covered operational security fundamentals for protecting critical information and activities from adversary intelligence collection.

Integration with Security Planning

The threat assessment and OpSec methodologies covered in this chapter provide the analytical foundation for all subsequent security planning and implementation. The communication systems, operational procedures, and advanced techniques covered in later parts of this manual should be selected and configured based on the threat assessment and risk analysis conducted using these frameworks.

Continuous Process

Threat assessment and OpSec are not one-time activities but ongoing processes that must be regularly updated as the operational environment changes. New threats emerge, adversary capabilities evolve, and operational requirements shift, requiring continuous monitoring and adaptation of security measures.

Next: Part II: Secure Communication Systems →