DNS Abuse Forum - May 25

Home / Blogs

Loose Lips

When I was in the military, we were constantly drilled about the problem of Essential Elements of Friendly Information, or EEFIs. What are EEFis? If an adversary can cast a wide net of surveillance, they can often find multiple clues about what you are planning to do or who is making which decisions. For instance, if several people married to military members all make plans to be without their spouses for a long period of time, the adversary can be certain that a unit is about to be deployed. If the unit of each member can be determined, then the strength, positioning, and other facts about what action you are taking can be guessed.

Given enough broad information, an adversary can often guess at details that you really do not want them to know.

What brings all of this to mind is a recent article in Dark Reading about how attackers take advantage of publicly available information to form Spear Phishing attacks —

Most security leaders are acutely aware of the threat phishing scams pose to enterprise security. What garners less attention is the vast amount of publicly available information about organizations and their employees that enables these attacks.

Going back further in time, during World War II, we have —

What does all of this mean for the average network engineer concerned about security? Probably nothing different than being just slightly paranoid about your personal security in the first place (way too much modern security is driven by an anti-paranoid mindset, a topic for a future post). Things like —

Loose Lips Might Sink Ships Vintage World War II USA Military Poster

  • Don't let people know, either through your job description or anything else, that you hold the master passwords for your company or that your account holds administrator rights.
  • Don't always go to the same watering holes, and don't talk about work while there to people you've just met, or even people you see there all the time.
  • Don't talk about when and where you're going on vacation. You can talk about it and share pictures once you're back.

If an attacker knows you are going to be on vacation, it's a lot easier to create a fake "emergency," tempting you to give out information about accounts, people, and passwords you shouldn't. Phishing is primarily a matter of social engineering rather than technical acumen. Countering social engineering is also a social skill rather than a technical one. You can start by learning to just say less about what you are doing when doing it and who holds the keys to the kingdom.

By Russ White, Infrastructure Architect at Juniper Networks

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Comments

 Be the first to post a comment!

Add Your Comments

 To post your comments, please login or create an account.

Related

Topics

Domain Management

Sponsored byMarkMonitor

Threat Intelligence

Sponsored byWhoisXML API

Cybersecurity

Sponsored byVerisign

Domain Names

Sponsored byVerisign

Brand Protection

Sponsored byAppdetex

IPv4 Markets

Sponsored byIPXO

DNS Abuse Forum - May 25