Organizational Information Gathering * Organizational information gathering consists of the process of identifying critical organizational elements of intelligence an adversary will need about a target in order to best attack. Similar to competitive intelligence, organizational intelligence gathering focuses on understanding the operational tempo of an organization and gathering a deep understanding of the organization and how it operates, in order to best develop a strategy to target it.
- Acquire OSINT data sets and information - Pre-ATT&CK
- Data sets can be anything from Security Exchange Commission (SEC) filings to public phone numbers. Many datasets are now either publicly available for free or can be purchased from a variety of data vendors. Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line as well as in the physical world.
- Conduct social engineering - Pre-ATT&CK
- Social Engineering is the practice of manipulating people in order to get them to divulge information or take an action.
- Determine centralization of IT management - Pre-ATT&CK
- Determining if a "corporate" help desk exists, the degree of access and control it has, and whether there are "edge" units that may have different support processes and standards.
- Determine physical locations - Pre-ATT&CK(https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1059)
- Physical locality information may be used by an adversary to shape social engineering attempts (language, culture, events, weather, etc.) or to plan for physical actions such as dumpster diving or attempting to access a facility.
- Dumpster dive - Pre-ATT&CK
- Dumpster diving is looking through waste for information on technology, people, and/or organizational items of interest.
- Identify business processes/tempo - Pre-ATT&CK
- Understanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic.
- Identify job postings and needs/gaps - Pre-ATT&CK
- Job postings, on either company sites, or in other forums, provide information on organizational structure, needs, and gaps in an organization. This may give an adversary an indication of weakness in an organization (such as under-resourced IT shop). Job postings can also provide information on an organizations structure which could be valuable in social engineering attempts.
- Obtain templates/branding materials - Pre-ATT&CK
- Templates and branding materials may be used by an adversary to add authenticity to social engineering message.
- Identify supply chains - Pre-ATT&CK
- Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit organizational relationships.
- Determine 3rd party infrastructure services - Pre-ATT&CK
- A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available as 3rd party infrastructure services. These services could provide an adversary with another avenue of approach or compromise.