Open Source Intelligence for businesses
Back in the day, the term 'intelligence' as applied to information gathering was a shady one. It evoked images of spies, exchanging information in a John le Carré-type world of closed circles and privileged insiders.
In an age of online transparency, however, things are far less opaque. Open source intelligence (or, as the US military calls it OSINT), is a form of intelligence gathering that affects both state and non-state actors. Companies can use it – and be vulnerable to it – just as easily as governments.
OSINT involves gathering intelligence from the public domain. In the late forties, when the US military's operations in Asia set up specific OSINT operations, the process was as simple as reading the regional newspapers and listening to politician's speeches.
These days, with the wealth of online information available, it becomes relatively easy to garner information about an adversary - whether in the private or public sectors - using everything from news databases through to extracting information from documents, and even building up a footprint of computing networks using publicly-available tools.
Maltego, an OSINT tool, can be used to run 'transforms' on entities including email addresses, computer servers, individuals' names, and phone numbers. The tool can be used to create a rich visual diagram of how entities are linked together. It can even be used to write your own transforms, mining public documents for key terms and relationships.
Mining information from sources as diverse as LinkedIn, Facebook, and company SEC filings can yield powerful clues about individuals and the organizations for which they work. This doesn't even factor in forensic information that can be yielded from seemingly innocuous documents. For example, what does the EXIF information in photos from a key individual's Flickr account say about where they've been, and where, and who they were with? What might the metadata in a Word document say about the organisation who created it? And what might a corporate spy do with that information, if, for example, they were trying to socially engineer the names of engineers working on a secret product?
Companies that ignore the power of open source intelligence risk leaving themselves open to potential compromise. In an age where information trickles like water across physical and digital boundaries – is that a risk you can afford to take?