3

I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company.

And I'm fairly sure they could then be linked to a full name easily too.

I've raised this as a concern with our security team as I don't particularly like the idea but it's been brushed off as a fairly harmless thing to know valid employee numbers. I feel my concern over linking it to names was either badly worded or skipped because it wasn't addressed at all.

Am I right to be concerned or am I overthinking it? I don't really want to push back or do further testing if I'm being irrational.

3
  • 3
    Is the employee number used to validate support calls? That's always a big gotcha.
    – gowenfawr
    Feb 8, 2021 at 22:34
  • Coincidentally I needed to ring an external company in regards to support for a perk we get and all I needed was my employee number. So in theory I could have taken advantage of that perk.. But whenever I have rang it support, no, can't remember what I needed but employee number wasn't one of them Feb 8, 2021 at 22:37
  • 2
    I'm not sure if we can say how bad it can be, It all depends on what the ID is used for.
    – schroeder
    Feb 8, 2021 at 23:32

1 Answer 1

2

I would say that is a significant risk for several reasons, being:

  1. Even if employee numbers are not currently used as an ID method, they might be used in the future for this purpose. Some companies will use an employee number as a username as well, so if the attacker can find this and correlate it to a person's real given and surname then this would empower user enumeration.

  2. When end-users call or are called by support staff, it is far more convincing when the caller has access to even basic knowledge such as the employee's number. As most people will presume that only authenticated + authorized individuals will have the number it could allow an attacker to perform an social engineering attack.

  3. Phishing and malicious emails can be made more convincing as well; the attacker can use the number and the person's name in the email.

  4. If the employee numbers are easily found, there might be more severe exploits that have gone undetected. In addition there might be an exploit tied to how the numbers are found which is more severe but as no one has looked at this issue it has gone unnoticed.

  5. If the employee numbers are meaningful (e.g. contain division, can infer which employees have been there longer due to lower numbers, type of staff such as contractor or part-time etc...) then this would also help immensely with OSINT for a targeted attack or spear phisihing.

  6. If anonymity is expected by staff, this could violate this expectation. I doubt this is a major issue as it is easy to find where someone works through Facebook, LinkedIn, etc...

Hope this helps. My only advice as for pushing further on it or not is just to clearly communicate your concerns (with written evidence of course) and respect the decision by whoever is authorized to make it.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .