Business Partner Information Leaking

Question

I just went through a penetration test, and what was wierd was we had a comment back about a potential data leak via DNS snooping (I realise this is boiler plate, and also this is an internal only DNS, which adds complexity):

For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of that financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more.

I'm not asking why DNS snooping is or isn't a vulnerability

Similarly, there are occasions where the penetration testers return comments like "its possible to guess the OS you're using"...

This seems incredibly weird for me, because we often, publicly, talk about our partners and technology solutions:

• We do public talks about various topics and highlight our customers, projects, and partners to show off our technical ability
• we attend conferences about particular technologies, and help the communities in moving forwards to better solutions.
• We publish recruitment with a list of technologies that we use
• Our partners often publish that they use our services
• We sometimes publish (by law/regulation, as we're listed) significant contracts so our partners are a list

Is there a case that sometimes we are being over zealous in our analysis of the systems, where the information is easier come by elsewhere, or should we become a black box company where nobody says anything, and we recruit via vague statements, maybe via shell organisations so nobody knows what we do.

Basically: How do we balance time and effort spent looking and finding 'data leakage' about things vs being able to operate as a company, where is the line for our people what they can and can't talk about, how do we monitor and control that?

Answer 1

You are in the same boat as many, many other technology companies. If the pentest company did not factor in all of your points above into some context for the risks they identified, you might want to consider changing companies.

Information disclosure presents a risk. You need to assess that risk and determine if the impacts are high enough to require that you mitigate that risk.

You may determine that the risks are simply not high enough to worry about it, in which case you accept this risk.

You may accept that there is a risk, and instead of plugging all the leaks, you use other, cheaper, methods to reduce the risk to an acceptable level. For example, if someone can know what OS and version you are running, then when a vulnerability is announced, you must be faster to patch or block access to that vulnerability than you might be otherwise. If you can do that, then that's a better way forward.

Another term that is gaining traction is "digital footprint". What info is out there about you? What do you disclose? Once you understand that, you then need to decide what to do if a malicious actor had all that info. What would you need to do differently? The big one is not to trust a someone just because they happen to know something internal to the company. Trust must be formalised and cannot be based on knowledge or familiarity. For instance, someone saying that they are from your bank should never be enough to trust them. There needs to be established ways to determine trust beforehand (approved phone numbers, 2FA, etc.)

So, how do you move forward as a company? The best case is to assume that everyone knows everything and mitigate what that means for you.

Answer 2

Shoudln't the pentesters gauge whether your security is up to snuff while taking into consideration the level of information leakage? An attacker can gather all the information about your company, but information on a company itself doesn't get you past firewalls. You still need to execute all the technical bits to carry out a real attack, so maybe instead of worrying about how much information you should be giving out, like which hardware/software vendors you use, your financial partners, etc, you should do your best to minimize the actual attack vectors by educating employees, patching software, sound security procedures & systems, etc.

For example, an attacker can know all the vulnerabilities of the version of OS that most of your employees use, but if they cannot penetrate the network because you have good isolation, disabled all unused ports, have good Wi-Fi security, etc, it'll be pretty hard to compromise an actual workstation.