RECONNAISSANCE SUMMARY The remote assessment methodology focuses on direct observation of an organization and their infrastructure, consisting of passive reconnaissance of publicly available data sources ("Open Source Intelligence") This allows the auditor to identify publicly available resources (such as websites, extranets, email servers, but also social media information) connected to the organization and remotely gather information about those resources. PURPOSE While much of SAFETAG focuses on digital security challenges within and around the office, unintended information available from "open sources" can pose real threats and deserve significant attention. This also builds the Auditor's understanding of the organization's digital presence and will guide specific vulnerabilities to investigate once on site. THE FLOW OF INFORMATION Information Threats Results Threats Activity Actors Actors Capacity Capacity Activities Activities Barriers Barriers Assets Assets Vulnerabilities Vulnerabilities Reconnaissance Information Flow GUIDING QUESTIONS Depending on the organization's security needs, does it "leak" any sensitive information online (location, staff identities, program locations?) Can you identify partners or beneficiaries through the organizations sites? What is the pattern for staff e-mail addresses? Have any of the the organization's servers, users, or e-mail accounts been compromised in the past? APPROACHES Manual OSINT: Identify availability of partner, beneficiary, and current project information online using advanced Google searching and website-scraping. 35 Recon-NG: Use recon-ng to do automated web-based open source reconnaissance. 36 Social Network OSINT: Identify availability of staff partner, beneficiary, and current project information by searching social networks for information leaked about the organization. Page 34 of 240