3

I just went through a penetration test, and what was wierd was we had a comment back about a potential data leak via DNS snooping (I realise this is boiler plate, and also this is an internal only DNS, which adds complexity):

For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of that financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more.

I'm not asking why DNS snooping is or isn't a vulnerability

Similarly, there are occasions where the penetration testers return comments like "its possible to guess the OS you're using"...

This seems incredibly weird for me, because we often, publicly, talk about our partners and technology solutions:

  • We do public talks about various topics and highlight our customers, projects, and partners to show off our technical ability
  • we attend conferences about particular technologies, and help the communities in moving forwards to better solutions.
  • We publish recruitment with a list of technologies that we use
  • Our partners often publish that they use our services
  • We sometimes publish (by law/regulation, as we're listed) significant contracts so our partners are a list

Is there a case that sometimes we are being over zealous in our analysis of the systems, where the information is easier come by elsewhere, or should we become a black box company where nobody says anything, and we recruit via vague statements, maybe via shell organisations so nobody knows what we do.

Basically: How do we balance time and effort spent looking and finding 'data leakage' about things vs being able to operate as a company, where is the line for our people what they can and can't talk about, how do we monitor and control that?

4

You are in the same boat as many, many other technology companies. If the pentest company did not factor in all of your points above into some context for the risks they identified, you might want to consider changing companies.

Information disclosure presents a risk. You need to assess that risk and determine if the impacts are high enough to require that you mitigate that risk.

You may determine that the risks are simply not high enough to worry about it, in which case you accept this risk.

You may accept that there is a risk, and instead of plugging all the leaks, you use other, cheaper, methods to reduce the risk to an acceptable level. For example, if someone can know what OS and version you are running, then when a vulnerability is announced, you must be faster to patch or block access to that vulnerability than you might be otherwise. If you can do that, then that's a better way forward.

Another term that is gaining traction is "digital footprint". What info is out there about you? What do you disclose? Once you understand that, you then need to decide what to do if a malicious actor had all that info. What would you need to do differently? The big one is not to trust a someone just because they happen to know something internal to the company. Trust must be formalised and cannot be based on knowledge or familiarity. For instance, someone saying that they are from your bank should never be enough to trust them. There needs to be established ways to determine trust beforehand (approved phone numbers, 2FA, etc.)

So, how do you move forward as a company? The best case is to assume that everyone knows everything and mitigate what that means for you.

  • Thanks: I like the bolding of those keywords: the language of how to discuss this internally is still something I'm working on so that everyone understands each other. – Jmons Feb 6 '18 at 11:16
0

Shoudln't the pentesters gauge whether your security is up to snuff while taking into consideration the level of information leakage? An attacker can gather all the information about your company, but information on a company itself doesn't get you past firewalls. You still need to execute all the technical bits to carry out a real attack, so maybe instead of worrying about how much information you should be giving out, like which hardware/software vendors you use, your financial partners, etc, you should do your best to minimize the actual attack vectors by educating employees, patching software, sound security procedures & systems, etc.

For example, an attacker can know all the vulnerabilities of the version of OS that most of your employees use, but if they cannot penetrate the network because you have good isolation, disabled all unused ports, have good Wi-Fi security, etc, it'll be pretty hard to compromise an actual workstation.

  • Unless the attack is social in nature. Then all this data directly helps the attacker. – schroeder Feb 6 '18 at 17:59
  • That's why I included educating employees in my answer. – downwardCorgi Feb 6 '18 at 18:00
  • Again, this kinda duplicates my answer. – schroeder Feb 6 '18 at 18:00
  • I'm not sure: When the system[s] are large enough, the pen tester might be working under the assumption they don't have visibility on all the elements and therefore suggest that any data leakage is bad leakage. My question in wondering perhaps that if the pen testers (who did look for our usernames etc on things like linked in, and would do a social / phishing attack if we paid for it), Perhaps they would complain about our other social presences giving away this information. – Jmons Feb 9 '18 at 13:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.