How Much Does the Internet Know About You?

Imagine a stranger who has never met you. Within just a few minutes, they could potentially discover where you work, what you do, who some of your colleagues are, which social media accounts belong to you, and perhaps even details about your professional or personal activities.

They didn't hack your account.

They searched for you.

In an increasingly connected world, our digital presence leaves behind countless pieces of information. A LinkedIn profile, a public photograph, a company announcement, a comment on a social media post or even an event photograph can reveal more than we may realise.

Individually, these details may appear harmless. The real risk emerges when someone connects them together.

The Internet Leaves Clues

Think about the information you share online every day.

You update your professional profile. You announce that you have started a new job. You post a photograph from your workplace. You celebrate your birthday on social media. You comment on a company's announcement. You upload photographs from a conference or an industry event.

None of these actions necessarily represents a security problem on its own.

However, each post can become another piece of a much larger picture.

A person's name, workplace, job title, social media profile, colleagues and publicly available photographs can collectively reveal a surprisingly detailed picture of their identity, professional relationships and activities.

The important point is that the information does not necessarily need to be stolen.

It may already be available in public.

What Is OSINT?

This is where Open-Source Intelligence, or OSINT, comes into the picture.

OSINT refers to the process of finding, collecting, analysing and connecting information that is publicly available. The sources can be surprisingly ordinary: search engines, social media platforms, company websites, news articles, professional profiles, public documents, photographs, job advertisements and public announcements.

OSINT is not automatically hacking.

In many cases, it is simply the process of looking at information that is already visible and understanding what that information reveals when different pieces are connected.

That ability to connect information is what makes OSINT particularly valuable—and potentially dangerous.

Why Does OSINT Matter in Cybersecurity?

Before conducting a technical security assessment, cybersecurity professionals often begin with reconnaissance.

One of the first questions may be:

• What can we learn about this organization without accessing anything private?

A security professional may examine the organization's websites, publicly listed employees and departments, published documents, online services, job advertisements, technology-related information and previous public security incidents.

The objective is not simply to collect as much information as possible.

The real question is:

Could any of this publicly available information create a security risk if someone misused it?

This is why OSINT can form an important part of security assessments and threat intelligence activities.

When Public Information Becomes an Attack Opportunity

Consider a simple scenario.

An attacker discovers that David is the Finance Manager at a particular company. They then identify Sarah, who works in the Finance Department. The attacker discovers the organization's publicly visible email format and finds a social media post showing that Sarah recently worked with David on a project.

None of these discoveries necessarily provides direct access to the company's systems.
But together, they provide something else:

Context.

That context could potentially be used to create a more convincing impersonation or phishing attempt.

For example, an attacker might attempt to send a message appearing to come from David:

"Hi Sarah, this is David. Can you urgently process this payment?"

The message may appear credible because the attacker already understands who David is, who Sarah is and how they are connected.

This highlights an important cybersecurity principle:

The first step of an attack is not always sending the malicious link. Sometimes, it is learning who to target.

Public Information Does Not Mean Unlimited Permission

• There is an important distinction between information being publicly accessible and having the right to misuse it.
• OSINT has many legitimate applications. Cybersecurity professionals use it for security assessments, threat intelligence, incident investigations and research. Journalists, researchers and investigators may also rely on publicly available information for legitimate purposes.
• But using information to stalk, harass, threaten, impersonate, dox or deliberately target someone with a scam is fundamentally different.
• Responsible OSINT requires consideration of privacy, ethics, security and applicable laws.
• The fact that information can be found does not automatically make every use of that information appropriate.

Now Look at Your Own Digital Footprint

This raises a more personal question:

If a stranger searched for me today, what could they learn?

They might find your old social media posts, professional profile, photographs, usernames, workplace, public comments, conference appearances or information published by your organization.

• Each individual detail might seem insignificant.
• But when those details are connected, they can tell a story.
• And you may not be the only person reading that story.

You Don't Have to Disappear From the Internet

The answer is not to stop using social media or remove yourself completely from the internet.

The real objective is awareness.

Before publishing something publicly, take a moment to consider what the information could reveal.

• Could someone identify where you work?
• Could they identify your colleagues?
• Could they understand aspects of your routine?
• Could they discover information about your organization?
• Could the information make a future impersonation or phishing attempt more convincing?

If the answer is yes, it may be worth reconsidering whether that information needs to be publicly visible.

The Bigger Picture

Cybersecurity is often associated with sophisticated malware, advanced exploits and complex technical attacks.

But sometimes, an attack begins with something much simpler:

Information.

• A name.
• A photograph.
• A job title.
• A comment.
• A location.
• A company announcement.

One piece of information may appear insignificant. Several pieces, however, can become a remarkably useful intelligence picture when they are connected.

That is the lesson behind OSINT.

You don't have to be hacked to be exposed.

Sometimes, the clues are already there.

You just have to know where to look.

OSINT FILES - 01/05

Next: How Do They Find It?

If the information is already public, how do cybersecurity professionals—and attackers—actually discover it?

In the next episode of OSINT Files, we explore the techniques used to search, identify and connect publicly available information.

Your information may be public. Your security doesn't have to be.