how to have operational security