Full Report
Your social media profiles are an attacker's dossier. Learn how attackers use public data to build attack playbooks and what you can do to give them less to work with.
Analysis Summary
# Best Practices: Digital Footprint Reduction & OSINT Defense
## Overview
These practices address the risks associated with Open Source Intelligence (OSINT). Attackers aggregate public data from social media (LinkedIn, Instagram), corporate directories, and historical data breaches to build a "dossier" on employees. This dossier is used to launch highly targeted phishing, identity theft, and deepfake impersonation attacks.
## Key Recommendations
### Immediate Actions
1. **Sanitize New Hire Activity:** Delay "first day at work" posts by 2–4 weeks to ensure employees are familiar with internal security protocols before becoming public-facing targets.
2. **Audit Privacy Settings:** Set LinkedIn and other social profiles to "Connections Only" for contact information and friend lists.
3. **Credential Health Check:** Use tools like `dehashed[.]com` or `haveibeenpwned[.]com` to identify if personal or work emails are linked to known breaches; change any reused passwords immediately.
4. **Enforce Multi-Factor Authentication (MFA):** Ensure MFA is active on all accounts—especially personal emails and LinkedIn—as these are the "backdoors" to professional identities.
### Short-term Improvements (1-3 months)
1. **Digital Footprint Training:** Educate staff on "oversharing" risks, such as posting photos of boarding passes, office desks (which may show schedules/tech stacks), or empty homes during vacation.
2. **Voice/Media Baseline:** Limit public-facing high-quality audio clips (podcasts, webinars) where possible, or establish internal "safe words" for high-value transactions to counter AI voice deepfakes.
3. **Formalize Hiring Verifications:** Implement a strict identity verification process for remote interviews to prevent "catfishing" or fake candidates using stolen LinkedIn identities.
### Long-term Strategy (3+ months)
1. **Attack Surface Management (ASM):** Regularly scan for "staging" sites and secondary domains that may contain corporate data but lack enterprise-grade security.
2. **Personal-Professional Decoupling:** Phase out the use of personal devices for work (BYOD) unless managed by Mobile Device Management (MDM) to close the "gray zone" overlap.
3. **Continuous OSINT Monitoring:** Implement periodic searches for the organization’s high-profile executives to see what data is currently available to attackers.
## Implementation Guidance
### For Small Organizations
- Focus on low-cost education. Host a "Lunch and Learn" on how attackers use LinkedIn to find targets.
- Require the use of a password manager to prevent credential reuse across work and personal accounts.
### For Medium Organizations
- Implement a formal Social Media Policy that outlines what company information (tech stacks, office layouts, client names) should never be posted.
- Conduct mock phishing simulations that utilize "publicly available" info to show employees how convincing targeted attacks can be.
### For Large Enterprises
- Deploy automated monitoring for brand impersonation and fake executive profiles.
- Integrate HR and Security workflows to ensure new hires are briefed on OSINT risks during the onboarding process before their names appear in directories.
## Configuration Examples
* **LinkedIn Privacy:** Navigate to `Settings > Data Privacy > Who can see your connections` -> Set to **Only you**.
* **LinkedIn Visibility:** `Settings > Visibility > Edit your public profile` -> Toggle off specific sensitive sections (like "Groups" or "Education") for non-logged-in users.
* **Email Filtering:** Configure mail gateways to flag emails coming from domains that are "look-alikes" of the company’s own domain (e.g., `huntre5s.com` vs `huntress.com`).
## Compliance Alignment
- **NIST CSF (Identify):** Specifically aligns with Asset Management and Risk Assessment by identifying the external human attack surface.
- **CIS Control 14:** Security Awareness and Skills Training.
- **ISO 27001 (A.7.2.2):** Information security awareness, education, and training.
## Common Pitfalls to Avoid
- **The "Dark Web" Myth:** Assuming attackers only use the dark web. Most actionable data is on the open internet (LinkedIn/Google).
- **Ignoring Personal Data:** Assuming an employee's personal email breach doesn't affect the company. If they reuse passwords, the company is at risk.
- **Trusting Video/Audio:** Relying on voice or video recognition for sensitive approvals without an out-of-band verification (e.g., a phone call to a known number).
## Resources
- **Identity Breach Check:** `haveibeenpwned[.]com`
- **Data Search Tool:** `dehashed[.]com`
- **OSINT Framework:** `osintframework[.]com`
- **Threat Research:** `huntress[.]com/blog`