The Network Security Test Lab: A Step-by-Step Guide

CHAPTER 2 Passive Information Gathering

Whereas Chapter 1 examined what is needed to build a test lab. This chapter begins to explore how to utilize your new equipment. Although you might be eager to start loading advanced tools and learning more about exploits, this chapter focuses on your brain. This approach might not be what you were expecting, but when you are applying for a security position, you are not only selling your technical skills, you are also selling your ability to think and reason.

What I means is simply this, if you are hit by a denial of service attack tomorrow can you track back to the attacker and identify where the source IP address is located? What if your company is concerned that its posting too much technical information on its website, can attackers use this data? What if someone asks you to explain to them what Google hacking is; can you demonstrate how it is used? That is what I will focus on in this chapter. I will show you how some common types of nontechnical security leak. This chapter explores the ways in which information leakage can damage an organization and the huge amount of information that is publically available. The chapter also covers some common areas where attackers and others will look to gather information that gives them the potential to exploit a company or business entity.

This technique is known as operations security (OPSEC). OPSEC is the process of understanding how unclassified information can be gathered and used against ...