OUTPUTS Dossier of organizational, partner, and beneficiary "open sources" information exposed online. A list of e-mail address for members of the organization. Identification and mapping of externally facing services and unintentionally exposed internal services. Possible vulnerabilities in the websites and externally facing servers of the organization. Existing information about earlier breaches identified in the paste-bin search. Follow the proper incident response plan if high risk problems are identified. OPERATIONAL SECURITY While this does not focus on identifying of vulnerabilities, it may nonetheless expose certain threats, particularly with regard to publicly-accessible information that is presumed to be confidential, such as the identity of sensitive staff, the existence of sensitive partner- and funder-relationships, or the organization’s history of participation in sensitive events or travel to sensitive locations. PREPARATION RESOURCES Open Source Intelligence (General) Standard: Intelligence Gathering (The Penetration Testing Execution Standard) Guide: "Passive Reconnaissance" (Security Sift) Tool: "NameChk account search" (NameChk) List: "Open Source Intelligence Links" (Intel Techniques) List: "OSINT Tools - Recommendations List Free OSINT Tools." (subliminalhacking.net) Guide: "OWASP Testing Guide v4 - Information Gathering" (OWASP) Organizational Information Gathering Database: "find the email address formats in use at thousands of companies." (Email Format) Searching Online Courses: Power Searching and Advanced Power Searching online courses (Power Searching With Google) Page 35 of 240