In April we had a fortnight of unusually good phishing. Not the ordinary kind. The messages named our finance platform correctly, referred to the migration programme we were halfway through, and one of them addressed a member of my team by the job title she holds rather than the one on her profile. Two people reported it immediately, which is the only reason I am writing about it calmly.
I spent an afternoon finding out where somebody would have got all that, and I did not have to look anywhere clever.
Our own job advert for an infrastructure engineer, live at the time, listed the firewall vendor, the backup product, the virtualisation platform and the version of the operating system we were standardising on, because the agency had been told to make the advert specific enough to filter applicants. A supplier case study on their website named us, quoted my colleague by name, gave the number of depots and described what we had replaced and when. A conference talk given in good faith by one of my engineers contained a slide with real host names on it. And a tender response we had sent to four prospective customers included an architecture diagram, marked confidential, and sitting in a procurement portal belonging to somebody else.
None of that is a breach. Every piece of it was published deliberately, by people doing their jobs properly, to recruit, to sell and to be helpful. Collected together it is a better description of our estate than anything my department has ever produced internally, which is the detail I have found hardest to live with.
We have made dull changes. Adverts describe the work and the skills and not the versions. Case studies need approval, and two suppliers have agreed to remove ours. Talks get read by somebody before they are given. Tender responses carry no diagrams.
Once a year we now spend an afternoon finding out what a stranger can learn about us without doing anything unlawful. The first attempt ran to nine pages.
We guard our estate carefully on the inside and describe it in public for good money, and until April nobody had ever put the two halves side by side.
– Serguey Shinder
