A transit purple team runs live authorized social-engineering scenarios. Which OPSEC practice best protects the engagement?
Select an answer to reveal the explanation.
Short Explanation
Live SE drills are like undercover training—blabbing the playbook on social media ruins the test and tips off the wrong audience. Keep live scenarios off public posts and open vendor channels.
Full Explanation
Operational security for live authorized municipal social-engineering scenarios requires keeping scripts, lure details, timing, and rules of engagement inside approved channels with need-to-know participants. Discussing live scenarios on public social media or other open channels can tip targets, collapse measurement validity, and leak methods to unintended audiences—including adversaries watching civic accounts. Transit purple teams therefore treat silence about live SE content as a core OPSEC control, not optional etiquette.
Posting scenario scripts publicly so employees can study them in advance fails by concept: advance disclosure converts a controlled measurement into a known quiz and destroys fidelity. Streaming the exercise on agency social platforms for transparency broadcasts TTPs and may embarrass staff while invalidating results. Sharing ROE and lure details in any Slack workspace that includes vendors overshares sensitive engagement data beyond authorized testers and sponsors.
Exam caveat: OPSEC for live drills is not secrecy from sponsors, safety officers, or the written ROE owners who must approve scope. After-action training materials can later summarize themes without publishing exact live lure text during the engagement window. Distinguish public transparency about having an awareness program from broadcasting operational details of an active test.
Operational check: Before go-live, verify distribution lists exclude public channels and unmanaged vendor spaces; require marked-sensitive channels for scripts and ROE; and brief participants that discussing live scenarios outside those channels is an OPSEC violation. Spot-check that no posts, tickets, or group chats expose lure language while the exercise is running.