OSINT Security Assessment
OSINT Security Assessments entail a number of different approaches to ensure that your company is not leaking sensitive information to the public. This could include API keys, personal information, passwords, email addresses and much more information that could leave your company or customers vulnerable to attack. We use publicly accessible information and a number of dark web sources to ensure that your company’s data is safe, and ensure that your company’s private information remains private. The defining feature of an OSINT assessment is that the information is collected from public sources meaning that anyone can find this information and use it against the company.
What do we test for?
We test for any information leaked online which would be protected by GDPR, as well as information that could be useful to an attacker if they were planning an attack. This can include software versions used, API keys, GitHub repositories and collection of information like this can build a profile about the organisation and its associates. Data is often collected without the knowledge of the company being attacked. We also create a footprint of any services or infrastructure that can be found on a company allowing you to know the footprint of your organisation and better protect that information so that it cannot be used against you.
What are the risks?
APTs(Advanced Persistent Threats) often start by doing large amounts of public reconnaissance on organisations they mean to attack. This allows them to build out a footprint for an organisation and use that against them to compromise their security. This can take the form of spear-phishing with information that shouldn’t be public or learning about insecure resources which are more easily exploited. The information collected can lead to loss of customer data, doxxing of important shareholders and compromise of essential information and infrastructure in a way that could have been prevented.
How we can help
We work with organisations to secure their digital assets and footprint using an OSINT assessment. The removal of information and the hiding of confidential information can ensure that an attacker does not get the chance to use it against an organisation. Preventing a vital part of the attacker’s attack chain and removing information that could be used by a hacker to compromise a company. Companies are often unaware of the information they are leaking online, and without help and a comprehensive report, it allows our clients to ensure that they are aware and take steps to protect themselves and their customers.
Contact a consulting team member by phone, email, or pigeon post. We will then discuss whether we can help you and arrange a scoping meeting to discuss your requirements.
In the scoping meeting, our team will discuss your requirements in further detail. Our team will ask questions in regards to the following:
Our expert consultants will discuss and finalise which digital assets you need testing in the scoping meeting. Based on the requirements, we will then assemble a project proposal and quote and agree on a schedule for conducting the security assessment. Our proposal document will include the following information:
The Penetration Testing starts. A member of our Penetration Testing team will liaise with a member of your company throughout the entire testing process. You will be the first to know if we have any questions or concerns. Our testing team will be on hand throughout the penetration test lifecycle to answer any questions or concerns. Our tester will:
A Penetration Test is useless without a well-written report. Our reports are written in plain English, concise, and thoroughly documented. The Penetration Test Report is typically furnished within 5 days after the testing phase is complete. If you are interested in seeing an example report, please contact our team.
Each report details the following:
At Sencode, we offer free retesting for every Penetration Test we conduct. You fix the issues; then we will verify they can no longer be exploited by an attacker. Our team will arrange a mutually suitable time to conduct the retest, after the remediation efforts have taken place. Our tester will follow these steps:
Our clients receive a testing certificate that can be shared with partners and customers, showing that their company takes security seriously. The certificate and document are designed to be easily digested by third-party suppliers, the document removes the technical details and can be safely distributed.
The Security Testing Certificate is available on request, after the retest has been complete. The security certificate shows:
Get in touch for a consultation.
Contact a consulting team member by phone, email, or pigeon post. We will then discuss whether we can help you and arrange a scoping meeting to discuss your requirements.
In the scoping meeting, our team will discuss your requirements in further detail. Our team will ask questions in regards to the following:
Frequently Asked Questions
If your company has an online presence, you should consider getting an OSINT assessment. The requirement for an assessment grows in proportion to the size of the company and the amount of data it collects.
Hackers will frequently automate the process of data collection, targetting large amounts of companies in the process.
Unfortunately, data leakage is a common occurrence, and even with safe data management policies in place, it can go undetected and have disastrous consequences.
OSINT (Open-source intelligence), is the term given to denote the process of data collection and reconnaissance of publically available data on a specific target. It often involves the use of social media and more technical searches.
OSINT falls into 3 different categories:
– Passive data collection, where the attacker has no contact with the organization.
– Semi-Passive, where an attacker disguises their activities within what is typical network traffic.
– Active data collection, where an attacker actively collects data from a target infrastructure with no regard for detection.
In penetration testing, reconnaissance is the process of gathering usefuldata about a target that can be used later in the attack. This usually entails retrieving the IP addresses of the servers that are being attacked, as well as understanding which software versions are installed on the host machines using a variety of techniques.
This stage is critical for an attacker since it provides a foundational understanding of a target’s infrastructure, which they may then attack and exploit.
Contact us
Get a free, no obligation quote from one of our expert staff.