Increasing adoption of convenient and emerging technologies blurs the line between our physical and virtual worlds. This creates digital footprint risk for organizations of all sizes and puts unique pressures on IT and security teams. This article increases awareness of the types of digital footprint information that can be exploited by threat actors and presents opportunities for managing digital footprint risk.
Recent incidents remind us that threat actors who exploit digital footprints can compromise competitive advantage, intellectual property, systems, and more. Information in your organization’s digital footprint could be targeted by a threat actor to infect your organization with ransomware, steal IP, access to your corporate network, abuse your computer resources, and more.
Your Disparate Online Information Can Be Combined by Threat Actors
Digital footprint risk involves intentional and unintentional information about an organization that can be discovered on the Internet. This information includes social media presence, collaboration platform communications, company employment/product/service reviews, mobile application use, Cloud use, and more.
It can be collected by cyber criminals, industrial competitors, hackers, threat actors, or data brokers to create a profile of your organization or your employees. The data broker industry also collects and sells corporate and individual information to search engines, companies, and more.
Once collected, this online information can be mishandled or used to profile your company for nefarious purposes. For example, spam emails, calls from third-parties, identity theft, reputation harm, or dissemination via the Dark web.
Update on 04/09/2021: Facebook details of more than 530 million users were exposed on a hacker forum in 2019, including phone numbers and other profile details. “Malicious actors” scraped user profiles using a now patched vulnerability in the platform’s tool for syncing contacts. Separately, in early April data purportedly scraped from 500 million LinkedIn profiles was for sale on a popular hacker forum, including full names, email addresses, phone numbers, workplace information, and more.
Dynamic Digital Footprint Landscape
One assumption we often hear about digital footprint risk is that some organization’s only look at their social media presence, or online marketing activities. This approach lacks consideration that their digital footprint may actually be a lot bigger than they realize.
Evaluating data flows for an organizations most critical data may reveal vulnerabilities in how the data is stored, accessed, or handled. For example, some employees may use and share corporate digital assets and sensitive information via uncontrollable digital media or shadow IT services.
We also recently observed the following key considerations for enterprise digital footprint risk:
- Executives were six times more likely to be a target of social engineering in 2019 than they were the previous year. Also, C-suite executives were 12 times more likely to be a target.
- A recent cybersecurity review indicates that a disturbing number of Android and iOS apps are using public cloud services in their backend as opposed to running their own servers. Additionally, a notable size of app misconfigurations were found to be exposing users’ personal information, passwords, and medical information.
- MegaFace, an open-source tool built by researchers at the University of Washington to develop AI, collected billions of photos without owner consent. MegaFace was downloaded 6,000 times by companies and government agencies worldwide.
Threat Actors Seek Company and Employee Information
Types of company information that threat actors seek include number of employees, website information (e.g., content, DNS, WHOIS, etc.), social media presence, financial data such as compensation packages, and more. Types of employee information that threat actors seek digital footprint include addresses, email account, social media accounts, SSID/WiFi/Mac/Router/IP addresses, and more.
This information can also help threat actors guess potential answers to security questions like name of first pet, best friend, vehicle, etc.
Opportunities to Manage Enterprise Digital Footprint Risk
The following approaches can help you manage your enterprise digital footprint risk:
- Increase workforce awareness of digital footprint risk by providing training opportunities and engaging with peer groups such as your sector’s ISAC. Provide training on the mindset of cyber threat actors. Employees are a critical component of your cyber protection, yet consistently are the weakest link in the chain.
- Identify the data sharing practices for your organization’s most critical digital assets. This may include IP, financial information, medical information, proprietary information, PII, and more. This approach can help you prioritize recommendations and resources for managing digital footprint risk.
- Determine whether you have any insider device threats. A cyber threat intelligence solution or Deep or Dark web monitoring service can help you identify compromised devices that may be leaking IP or other sensitive corporate data.
- Set clear social media and Internet use policies for your workforce and the enterprise. Ensure that your workforce understands what types of corporate information may be considered inappropriate on social media and provide clear examples. Prevent your IT department from using PII for authentication to sensitive systems. For example, refrain from using birth dates, SSNs, or security questions that can be easily guessed from a quick Internet search.
- Evaluate how new technologies will impact your organization’s digital footprint prior to adopting them.
- Monitor your organization’s online image and work with website hosts to have overly negative or untruthful company reviews on job board sites or malicious Internet links removed.
Remember, information about your company and employees on the Internet will likely remain there FOREVER. Fairly resource and time intensive opportunities exist for you to pursue to clean your information off the Internet, but there are no guarantees.
Connect with GPSG’s Cyber experts at cyberteam@gpsg.co. We look forward to helping your organization navigate the current cyber threat landscape. Our objective is to make the most informed cyber and technology planning and investment decisions to achieve peak performance.
Disclaimer: This website provides ever changing content, conversations, and insights on cyber threats and trending solutions that is accurate to the best of our knowledge. Although we are cybersecurity experts, we provide information which we hope is helpful, and do not endorse any specific products, tools, or solutions referenced herein. Consult with your cybersecurity team before taking any action.