OSINT Collection Management

[Sherman Chu 8]

Hey folks, 

I'm sure that everyone in this club can agree that OSINT can be a very powerful force-multiplier in infosec, but how do ya'll manage the collection of OSINT?

Specifically, is the collection effort indexed and evaluated in a way that infosec teams (whether SMB or major-enterprise level) can go back and look at the efficacy, integrity, and veracity of said collection effort?

Do ya'll use frameworks such as the Admiralty System to evaluated OSINT data?

[Daniel Cuthbert 16]

The Admiralty System is one I use a lot, but it can be subjective and also a lot of work to get right. Over the years of doing this, I looked for inspiration from those who really pioneered this space and actually shared stuff, such as the CIA and other agencies. The CIA is actually phenomenal in this regard, this document, titled 'A Tradecraft Primer: Structured Analytic Techniques for Improving Intelligence Analysis' has been hugely influential in helping develop my own approach and methodologies. 

 

Using this approach, with the Admiralty System to score each source and piece of intel, I find I ended up with a smaller subset of sources but ones that produced far higher value intel as a result. Page 17 really hammered home the use of contrarian techniques to determine if a source is good or not based upon what it was showing you. As I said earlier, the CIA release many informative articles and papers on the subject, and if you haven't read them yet, I urge you to. For example, Sailing the Sea of OSINT in the Information Age by Stephen C. Mercado which is a great read.

I'm keen to hear how others approach this too

 

[Michael D 11]

What exactly are you all using OSINT for in infosec?

[james mckinlay 116]

11 minutes ago, Michael D said:

What exactly are you all using OSINT for in infosec?

I use it to keep the infosec propaganda marketing away 

[Daniel Cuthbert 16]

2 hours ago, Michael D said:

What exactly are you all using OSINT for in infosec?

A wide variety of tasks, from adversarial hunting to footprinting and more recently, vendor deep dives. For example:

- Vendor says they use a unique custom container approach to stop all malware from being an issue

- Me spends 24 minutes to find out actually they use React, Python, Ruby and ESXi and some bubble gum, an old loo roll and hope and prayers.

[james mckinlay 116]

vendor-myth-busting , should be an after school club for CS students or a scout badge

Edited September 10, 2019 by james mckinlay