Open Source Intelligence (OSINT)

OSINT covers a broad array of generally available sources: the media, including newspapers, radio, and television; professional and academic records such as papers and conferences; and public data such as government reports, hearings, and speeches. In the US intelligence community, OSINT is not the responsibility of any one agency. Its main advantage is accessibility, but the sheer amount of information makes it hard to know what is of value, and the source and reliability of the data can be hard to determine, so it still needs review and analysis.

In cybersecurity, defenders draw on open sources such as public websites, blogs, and data feeds for cyber threat information, alongside sharing communities, government repositories, and commercial feeds, and may collect indicators from open source repositories. In authorized security testing, testers simulating an external attack perform open source research on the target from public web pages, newsgroups, and similar sites, and CISA red team assessments have begun with open source research on the target organization.

Adversaries gather the same kind of information for reconnaissance. MITRE ATT&CK describes them searching freely available websites, such as social media, news sites, and pages about hiring or contracts, and technical databases, such as domain and certificate registrations, for information about victims to use during targeting. What they find can reveal opportunities for phishing and other ways in.

This activity is hard to detect because it often takes place outside the target organization's visibility, so detection efforts focus on related stages such as initial access. It cannot easily be prevented with security controls either, and defensive efforts focus on minimizing the amount and sensitivity of data available to outside parties, for example by keeping credentials and API keys out of public code repositories.