Editing Operational Security (OPSEC) (section)

== <span id="environment-isolation"></span>Environment Isolation ==

Environment isolation ensures that operational activity is compartmentalized, ephemeral, and non-attributable. The goal is to prevent bleed-over between real and operational contexts, while minimizing forensic residue.

* '''Bare-metal host:''' Harden BIOS/UEFI (disable boot from USB/network), disable Wi-Fi/Bluetooth, enable full-disk encryption (e.g., LUKS).  
* '''Virtual machines:''' Snapshot before mission; discard after use. Isolate via host firewall. Disable clipboard, drag-and-drop, and shared folders.  
* '''Containers:''' Run with restricted capabilities. Apply seccomp, AppArmor, read-only root, and user namespaces.  
* '''Live OS:''' Use [[Tails]] or [[Kali]] in Live mode. Operate from RAM. Avoid persistence unless encrypted and justified.  
* '''Air-gapped systems:''' For high-risk operations, use machines with no connectivity. Transfer via trusted media (e.g., optical or write-once USB).  
* '''Log handling:''' Disable or route logs to tmpfs. Never log keystrokes or session metadata unless explicitly needed and encrypted.  
* '''Persistence awareness:''' Avoid persistent user profiles or histories unless isolated per operation. Use RAM disks for temporary storage.  
* '''Network segmentation:''' Run isolated environments behind NAT, separate VLANs, or firewalled bridges. Block all unnecessary outbound connections.



----