Open-Source Intelligence (OSINT).

What is open-source intelligence (OSINT)?

Open-source intelligence, or OSINT, is information gathered from sources that anyone can access, such as websites, news sites, social media and search engines. The word “open” refers to the sources being public. It does not mean the software is open source. Security teams, researchers and attackers can all use it.

How does OSINT work?

The work usually starts with a question, such as what a company or person has made public. The collector then searches public places, notes what they find and checks whether it is accurate. This is a plain description of the general idea. The sources below show how it appears in attacker behavior.

How do attackers use OSINT?

MITRE ATT&CK is a public catalog of attacker behavior. It lists Reconnaissance as a tactic. MITRE describes this as the adversary trying to gather information they can use to plan future operations. It says this can include details about the victim organization, its infrastructure or its people.

MITRE also lists a technique called Search Open Websites/Domains. It says adversaries search freely available websites and domains for victim information used during targeting. MITRE names social media, news sites and business operation platforms as places this can happen. It says the information can help with phishing, technical database research, account establishment or initial access.

• Social media is one listed sub-technique.
• Search engines are another. MITRE says attackers can use specialized search syntax to find things like credentials or network details.
• Code repositories are a third.

A simple illustration

This is a generic illustration, not a real case. A public page lists the names and roles of a company’s staff. Someone planning a targeted message could use that page to choose who to write to. The page was meant for customers, but anyone can read it.

How can you reduce the risk?

MITRE says developers who upload to public code repositories should be careful to avoid publishing sensitive information such as credentials and API keys. It also advises scanning public code repositories for exposed credentials or other sensitive information before making commits. If credentials have leaked, MITRE says they should be removed from the commit history, not only from the latest version of the code.

Detection is hard. MITRE says this activity may have a very high occurrence and false positive rate, and that it often happens outside the view of the organization. For search engine use, MITRE points to minimizing the amount and sensitivity of data available to external parties.

How does OSINT relate to nearby terms?

The information an organization leaves in public view is often called its digital footprint. Threat intelligence is a wider practice, and OSINT can be one input to it. Social engineering is the practice of tricking people, and public information can be used to prepare it.

Is OSINT the same as threat intelligence?

No. OSINT describes where information comes from, which is public sources. Threat intelligence describes the purpose, which is understanding threats. A threat intelligence report can use public sources, but it can use other sources too.

Is OSINT legal or only for attackers?

OSINT is a method, not a side. Defenders can look at what is public about their own organization to see what an attacker could see. This page does not give legal advice, and rules can differ by country and by how the information is used.

See also

• Human intelligence (HUMINT)