Organizational Information Gathering

Table of Contents

Organizational Information Gathering * Organizational information gathering consists of the process of identifying critical organizational elements of intelligence an adversary will need about a target in order to best attack. Similar to competitive intelligence, organizational intelligence gathering focuses on understanding the operational tempo of an organization and gathering a deep understanding of the organization and how it operates, in order to best develop a strategy to target it.


Acquire OSINT data sets and information - Pre-ATT&CK

  • Acquire OSINT data sets and information - Pre-ATT&CK
    • Data sets can be anything from Security Exchange Commission (SEC) filings to public phone numbers. Many datasets are now either publicly available for free or can be purchased from a variety of data vendors. Open source intelligence (OSINT) is intelligence gathered from publicly available sources. This can include both information gathered on-line as well as in the physical world.

Conduct social engineering


Determine centralization of IT management


Determine physical locations

  • Determine physical locations - Pre-ATT&CK(https://attack.mitre.org/pre-attack/index.php/Technique/PRE-T1059)
    • Physical locality information may be used by an adversary to shape social engineering attempts (language, culture, events, weather, etc.) or to plan for physical actions such as dumpster diving or attempting to access a facility.

Dumpster dive

  • Dumpster dive - Pre-ATT&CK
    • Dumpster diving is looking through waste for information on technology, people, and/or organizational items of interest.

Identify business processes/tempo

  • Identify business processes/tempo - Pre-ATT&CK
    • Understanding an organizations business processes and tempo may allow an adversary to more effectively craft social engineering attempts or to better hide technical actions, such as those that generate network traffic.

Identify job postings and needs/gaps

  • Identify job postings and needs/gaps - Pre-ATT&CK
    • Job postings, on either company sites, or in other forums, provide information on organizational structure, needs, and gaps in an organization. This may give an adversary an indication of weakness in an organization (such as under-resourced IT shop). Job postings can also provide information on an organizations structure which could be valuable in social engineering attempts.

Obtain templates/branding materials


Identify supply chains

  • Identify supply chains - Pre-ATT&CK
    • Supply chains include the people, processes, and technologies used to move a product or service from a supplier to a consumer. Understanding supply chains may provide an adversary with opportunities to exploit organizational relationships.

Determine 3rd party infrastructure services

  • Determine 3rd party infrastructure services - Pre-ATT&CK
    • A wide variety of cloud, virtual private services, hosting, compute, and storage solutions are available as 3rd party infrastructure services. These services could provide an adversary with another avenue of approach or compromise.