Open Source Intelligence (OSINT) is a powerful tool that, while used by threat actors for criminal purposes, is also the first line of defence in securing your external attack surface. In this post, we'll dive into what OSINT is, how it is used by bad actors, and how you as an IT professional can use OSINT to understand (and therefore protect) your digital footprint.

‍

What is OSINT?

‍OSINT is data from publicly available sources that can be analyzed to make informed decisions about cybersecurity threats or issues. It includes anything publicly accessible about your external attack surface, from visible website vulnerabilities to insecure email and DNS settings. It also includes publicly available information from blogs, social media, annual reports, and other online platforms that mention your organisation, or specialist forums where potential threats or vulnerabilities are discussed.

Monitoring and understanding OSINT is the process of analyzing data from publicly available sources to make informed decisions about cybersecurity threats or issues. This provides insights into what assets are visible, accessible, and potentially susceptible to attack. This area of cyber is also known as the ‘external attack surface’. Monitoring this surface is critical as this public information could contain data that may be exploited by a bad actor to target your organisation.

A simple search of an organisation’s name can reveal subdomains, compromised user accounts, the strength of email security, website's security status, and much more. While bad actors can exploit this information, it also provides a valuable starting point for securing your external attack surface.

With this view, it's then possible to understand where a hacker might start to try and gain access to your organization to orchestrate an attack. It might be that you have a vulnerability in your website that allows access through known attack techniques or that you have not enabled anti-spoofing on your email domain, which will make it much easier for a phishing email to look legitimate and result in someone clicking on a malicious link.

‍

How can I use OSINT to understand my digital footprint today?

‍OSINT is the first step in the defence against attacks via the external attack surface, as when used properly, it gives you the inside running on how to stay ahead of threat activity.

However, the first step - gathering data and insights from an enormous range of sources - is incredibly time-consuming. Look at the OSINT framework below to get a snapshot of what types of information are available. It is mind-boggling, especially if you need to interrogate each one individually or if cybersecurity is just one part of your busy IT role.

Automation plays a crucial role in the collection and analysis of OSINT. It's impossible to keep up to date with the expanse of your external attack surface and the continuous changes in it without automation. Vulnerabilities in code are constantly being discovered and exploited; new tactics are being developed all the time, and AI has the potential to speed up how quickly new threats propagate. It's more than one person or a small team can possibly tackle on their own.

Tools like, Glasstrail do all the hard work of finding the risks and vulnerabilities in external attack surfaces for you. It's like having a dedicated member of team just focused on risk identification – and really all businesses should start today (a free trial is available for all businesses). This leaves you with the task of remediating and managing any risks. When using Glasstrail you're one step ahead of where you'd be if you were trying to find all the risks yourself.

‍

A note on the irony of OSINT and AI and Machine Learning

Ironically, generative AI is an example of OSINT in its most potent form. Machines gather endless publicly available data, publications, and online information and instantly serve that up in a super accessible format for anyone who requests it. Unfortunately, this makes more information more accessible to bad actors too.

The exciting thing is that AI will help us to solve problems faster, and hopefully, this will translate to building better tools for defending our assets and blocking attacks more quickly. As external attack surfaces are constantly changing, the role of AI and machine learning in transforming OSINT is becoming increasingly significant.

Understanding how OSINT gives you a heads-up about risks and vulnerabilities is vital for anyone involved in cyber security. The more you understand your digital footprint, the easier it'll be to protect your network and data from bad actors. It's this insight that'll allow you to work on your defensive strategies and tactics.  Now is the right time to use OSINT in your data security efforts.

‍

‍

‍