📖 What is OSINT (Open Source Intelligence)?
OSINT (Open Source Intelligence) is the collection and analysis of data gathered from publicly available sources to produce actionable intelligence. This includes social media, public records, domain registrations, and forums to identify potential threats. Analysts use OSINT to map an organization's external footprint and identify potential entry points for attackers.
"For the exam, focus on how OSINT is used by both attackers during reconnaissance and defenders during threat intelligence gathering."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of OSINT (Open Source Intelligence)?
- ▸ Passive reconnaissance involves gathering data without interacting with the target system, such as reviewing WHOIS records or social media profiles to avoid detection.
- ▸ Active OSINT involves interacting with target infrastructure, such as scanning public-facing ports via Shodan or Google Dorking to find hidden directories.
- ▸ The intelligence cycle transforms raw public data into actionable intelligence through a process of collection, processing, analysis, and dissemination to stakeholders.
- ▸ Defenders use OSINT for attack surface management, identifying leaked credentials or exposed sensitive documents that could be leveraged by a malicious actor.
- ▸ Common OSINT tools include search engine operators, DNS reconnaissance tools, and social media monitoring to map organizational hierarchies and technical stacks.
🎯 How does OSINT (Open Source Intelligence) appear on the CS0-003 Exam?
You may be asked to identify which phase of the Cyber Kill Chain an attacker is in when they are searching LinkedIn for employee roles and technologies used.
A scenario might describe an analyst using Shodan to identify outdated firmware on public-facing IoT devices, requiring you to categorize this activity as OSINT gathering.
Expect questions where you must choose the best source for identifying a company's registered IP ranges and domain ownership, pointing toward WHOIS or ARIN records.
❓ Frequently Asked Questions
What is the primary difference between passive and active OSINT?
Passive OSINT occurs when the analyst never touches the target's infrastructure, using third-party caches or records. Active OSINT involves direct interaction, such as querying a DNS server, which may be logged by the target.
How does OSINT differ from HUMINT or SIGINT?
OSINT relies exclusively on publicly available information. HUMINT involves interpersonal contact with human sources, while SIGINT involves intercepting electronic signals or communications, which typically requires specialized government capabilities.