Enterprise Reconnaissance: How Attackers Map Your IS

The Importance of the Reconnaissance Phase

The reconnaissance phase is a fundamental step for any attacker. It allows for the collection of maximum information about the target before launching an attack. Without a thorough understanding of the information system, the technologies used, and the organization, a successful intrusion becomes much more difficult, if not impossible. This phase determines the attack strategy and the choice of potential vectors.

Common OSINT Methods Used by Cybercriminals

Cybercriminals employ various OSINT techniques to gather data. This includes searching search engines, analyzing social networks, examining company websites, consulting public records, and exploiting information available about employees. The goal is to build a detailed view of the target's infrastructure and operations.

Information Sought by Attackers

Key information sought by attackers includes public IP addresses, domain and subdomain names, technologies used (software versions, frameworks), employee email addresses, organizational charts, apparent security policies, and any information that can identify known vulnerabilities or potential entry points.

Mapping an information system reveals multiple attack angles that every cybersecurity expert must know.

Information Systems (IS)

The set of hardware, software, human, and informational resources organized to produce, process, store, and disseminate information.

Vulnerabilities

Weaknesses in the design, implementation, or exploitation of a system that can be exploited by a threat.

Potential Entry Points

Physical or logical access points that an attacker could use to penetrate a network or system.

Technologies Used

Identification of the software, hardware, and services deployed by the company, which may have known vulnerabilities.

Digital Footprint

The set of traces left by an organization on the Internet, including its website, social networks, and public information about its employees.

Attack Surface

The total number of access points that an attacker can exploit to gain access to the company's information system.

Evaluation of Reconnaissance Methods

Reconnaissance methods vary in complexity and potential impact. Here is a comparison of commonly used approaches by attackers to evaluate their effectiveness and associated risks.