I just went through a penetration test, and what was wierd was we had a comment back about a potential data leak via DNS snooping (I realise this is boiler plate, and also this is an internal only DNS, which adds complexity):
For instance, if an attacker was interested in whether your company utilizes the online services of a particular financial institution, they would be able to use this attack to build a statistical model regarding company usage of that financial institution. Of course, the attack can also be used to find B2B partners, web-surfing patterns, external mail servers, and more.
I'm not asking why DNS snooping is or isn't a vulnerability
Similarly, there are occasions where the penetration testers return comments like "its possible to guess the OS you're using"...
This seems incredibly weird for me, because we often, publicly, talk about our partners and technology solutions:
- We do public talks about various topics and highlight our customers, projects, and partners to show off our technical ability
- we attend conferences about particular technologies, and help the communities in moving forwards to better solutions.
- We publish recruitment with a list of technologies that we use
- Our partners often publish that they use our services
- We sometimes publish (by law/regulation, as we're listed) significant contracts so our partners are a list
Is there a case that sometimes we are being over zealous in our analysis of the systems, where the information is easier come by elsewhere, or should we become a black box company where nobody says anything, and we recruit via vague statements, maybe via shell organisations so nobody knows what we do.
Basically: How do we balance time and effort spent looking and finding 'data leakage' about things vs being able to operate as a company, where is the line for our people what they can and can't talk about, how do we monitor and control that?