Movies and TV shows like to depict hackers as lone, hoody-wearing men in a dark room, slugging energy drinks and typing furiously on a keyboard surrounded by screens. In truth, many hackers operate in cubical farms surrounded by other hackers, with a manager walking around directing them. They’re collecting information from websites about who works at their potential targets, calling the phone number on the website to check out responsiveness and going into Instagram, Facebook and Twitter to gather intelligence about the potential victim they can use as a mule to carry out their attack. They’ll purchase databases of data breach material to develop a profile on their victim and gather potential passwords or credentials to help with their attack.

This is called the Reconnaissance phase of an attack. Attacks are usually non-random, well informed and strategised to be as successful as possible.

We introduced Dumpster Diving previously - the act of physically retrieving paperwork, USB sticks and hard drives (not an exhaustive list!) thrown into bins and dumpsters. It's a common reconnaissance method used by hackers to investigate their potential victims. Hackers might focus on only one person inside their target organisation, or try everyone they can get information on, to find the weakest link.

The reason this training exists is because people remain the most reliable target for a hack. Every year, the Australian Signals Directorate publishes their hack report, and every year, humans are the number one vector for CyberAttacks. While scatter-bomb attacks (for example, an email sent to 20,000 email addresses) are common, focused attacks are also just as common and usually more successful.

Reconnaissance relies on the availability of information about the target and is often gathered from the Internet profile of the target, whether they be a business or individual. Being aware of what information about us is publicly accessible is important, and controlling what private details are released is essential.

Things we can do to disrupt Reconnaissance:

Limit publicly available information - Review what's on your company website, social media, and job postings.Avoid posting detailed technical information about your systems, software versions, or network architecture and do not advertise when you're on vacation.2. Control information employees share - Train staff not to overshare on LinkedIn or social media about specific technologies, security tools, or internal processes; Job postings shouldn't list every specific tool and version number of software you use in your business - attackers mine this information to better understand your environment.3. Monitor for scanning activity - Watch for suspicious emails or phone calls that probe your network or website details. Unusual numbers of requests, contact form emails, odd phone calls regarding your business technology or similar - think the Internet version of noticing someone slowly walking past your house multiple times taking photos.4. Use deception techniques (honeypots) - Set up fake web pages or data that look valuable but are actually traps - When attackers interact with them, you get an early warning about who might be gathering information about your business. The real like version of this is leaving a fake wallet in plain sight to catch a pickpocket.5. Hide your technology fingerprints - remove software details from error messages, websites and login pages - Don't announce "Powered by [specific software version]". This makes it harder for attackers to know exactly what exploits might work.

Lesson 2. Reconnaissance