16

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, limited email access and so on.

Is it a good practice to force employees to hide their employment status from the public to avoid being targeted for hacking (e.g. remove the employer from LinkedIn)?

  • 20
    "Is it good practice?" or "Is it effective?" Who are the threat actors? – schroeder Jun 11 at 12:17
  • 13
    You might want to check with local laws first. Forcing employees to not reveal who they work for on linked in may be seen as an anti-competitive, and anti-labor and may not even be legal. I'd tell the company to stuff it if they said I can't post who I work for on a website. – Steve Sether Jun 11 at 16:10
  • 28
    "security fobs, vpn, password managers, non-sms 2FA, limited email access and so on." The problem seems obvious to me: you're describing technical solutions but you're worried about a human vulnerability. Are you doing anything to train the staff on how to respond to social engineering or phishing? All the password managers and policies in the world will fail to help if you're not also emphasizing the behavioral element. The tech- and policy-heavy approach can lull people into a false sense of security, if anything. – dwizum Jun 11 at 20:27
  • 71
    It really depends on the company's threat model, where did you say you worked again? – David Houde Jun 11 at 21:43
  • 4
    en.wikipedia.org/wiki/… even the US Gov't can't manage to keep secret the people who have top secret clearance, keeping it secret who works for you may not be a particularly strong mitigation. Are the e-mail addresses not going to gradually show up in mined data anyway? – Affe Jun 12 at 1:36
23

Hiding your employer would not appear to be of any use at all when you want to hide the employee's email address from the public. If you hide your employer info but spread your contact details far and wide, the employer info is not interesting.

The assumption being made is that once you know the company name and the employee name, then one can freely email the employee. Trying to address the threat of incoming emails by trying to hide the company name, so that the email address domain can't be guessed, so that emails cannot be addressed is trying to push on the wrong end of the lever of control. And you are trying to do it with a wildly difficult policy to enforce.

The trivially effective control is to break the direct tie between company name, employee name, and email address.

I know of companies that stand up a separate domain to send emails from. So example.com stands up example-email.com. This immediately wipes out a lot of automated emails. Other companies salt the email address with 2-4 numbers, so kelly.smith@example.com becomes kelly.smith.1234@example.com. Others use only the employeeID number: 12345678@example.com.

While each one of these can be overcome through analysis of other disclosed email addresses from the company, it is more effective and much, much easier to control and enforce through technical means than forcing people not to disclose where they work.

The company name is simply not the primary data to control in this threat scenario. It's the email addresses. You can control those.

Managing digital footprint is always a good consideration but you have an awareness problem and a trust problem with your employees that such a policy is not going to address.

  • 1
    Does not fully make sense to me. If one knows from Linkedin that Mr. John Doe works for acme (acme.com), would they try to contact/phish john.doe@acme.com first? – usr-local-ΕΨΗΕΛΩΝ Jun 12 at 14:14
  • 2
    Perhaps, but then they would have to figure out the naming convention, etc. The primary thing to protect, in the proposed threat scenario, is the contact details. If that's the concern, then you can do things like not use the person's name in the email, etc. – schroeder Jun 12 at 15:03
  • 1
    It's not just a matter of wanting to hide the employee's e-mail address. It's a matter of not wanting to advertise who works there, so that they're less likely to be targeted for spear phishing (or, depending on the attacker and their objectives, even hostage-taking) in the first place. If an attacker doesn't know the employee is an employee in the first place, they won't care what their e-mail address is or be looking for it. Of course, this is assuming that they're not advertising their employer by using an employer-provided e-mail account for personal reasons. – reirab Jun 12 at 20:38
  • 1
    @schroeder there's less than a dozen common naming convention. It's not a terribly difficult thing to brute-force and easily automated. – Tom Jun 13 at 8:08
  • 1
    @reirab but that's incredibly difficult to control or prevent. Protecting the email address is the trivial control. – schroeder Jun 13 at 13:46
22

The best security practice is to train the employees specifically to avoid phishing and scams in general. Also, you need to test them periodically, to check if they are actually reacting to scams as they were trained to do. Password managers with auto-complete functionality might also help because they can be used to detect wrong URLs before entering sensitive data on the internet. Hiding employment status seems useless to me, because its usefulness is going to be negligible compared to the best practice I mentioned above (training and testing).

11

Schroeder's answer explains things very well, but I would like to offer a different view.

Employees will likely act online. They will ask questions on Stack Exchange, in support forums of vendors, etc.

If it's apparent whom they work for (e.g. by using the email address j.doe@awesomecorp.com), then an attacker looking to gain information about Awesome Corp will be able to gather information about systems being used by the company. Depending on how much information they (knowingly or unknowingly) expose, this may include:

  • Configuration data
  • Products and versions thereof used by the company
  • Credentials
  • Internal addresses
  • Etc.

While this in itself may not directly constitute a vulnerability, it can show an attacker potential entry points and allows them to more efficiently understand the architecture of Awesome Corp.

The idea that J. Doe should hide that he is working for Awesome Corp is not necessarily useful. The problem arises when J. Doe discloses internal information.

As such, employing an information disclosure policy is very useful for the company. It should contain which information can be shared with vendors, the public, etc. In addition, employees should have someone to talk to if they are uncertain whether or not something is considered internal information.

  • That's all good too, but not about phishing or social engineering, as the OP is focused. – schroeder Jun 11 at 12:43
  • 3
    @schroeder And it's mentioned that it shouldn't be a concern, in general. You can observe this on every conference, when people start with "Hi, my name is ... and I work for ...". – MechMK1 Jun 11 at 12:45
  • 7
    I disagree, in the sense that these two are closely related. "Hiding your employer for the sake of not being targeted for phishing" and "Hiding your employer for the sake of preventing information gathering" are, in my opinion, related enough and provide value to the question. Feel free to disagree though. – MechMK1 Jun 11 at 12:53
  • 4
    I don't understand the point you make. I pointed out related things one needs to be aware of. I never claimed that my answer was "complete" (whatever this may mean in this context), only that it was another thing to be aware of. What exactly are you getting at? That the answer is "not an answer" (and should therefore be deleted) or that the answer is incomplete? – MechMK1 Jun 11 at 13:09
  • 5
    And I told you in my previous comment that I don't believe it's unrelated, giving you a reason why I feel that way. – MechMK1 Jun 11 at 13:43
2

I've worked with people in law enforcement and security arenas, and sometimes it is essential that you hide your employment from the public. When I was working on software products that would be used by the Northern Irish police, I was told specifically to not mention who I was working for, we even had to remove the company brands and name from the products in case it led to targetted attacks.

Soldiers and police are told not to wear their uniforms en route to work, to wear civilian dress and change at work, for unfortunately obvious reasons.

So, yes, I don't see why this woulnd't apply to any other sensitive company even if its nowhere near as serious as some of the examples I could give. You'll still need to be aware of the threats, and the threats may come your way regardless, but there's no reason to encourage them.

YMMV as to how effective you want to make it, or how seriously you take the threats to be, remembering that it would only a small part measure in tackling the problem.

  • I wonder how far this extends into private life. Are police officers told not to disclose to anyone that they are police officers? – MechMK1 Jun 14 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.