OSINT in Corporate Security: From the Digital to the Physical

When talking about corporate security, many might think only about the digital infrastructure of companies. However, this component—cybersecurity—is only one side of the coin. Beyond online threats, organizations must deal with substantial dangers in the real world. When the potential risks combine with a constantly shifting business environment, company environments can quickly become a powder keg. With so much that can go wrong, the danger is very real.

In this article, we focus on the essential role of OSINT in corporate security. We look at the field's critical challenges in 2023, reveal how open-source intelligence combats arising threats, and how security teams can profit from using the technology.

Let’s get to it!

• The Anatomy of Corporate Security
• Key Challenges of Corporate Security in 2023
• OSINT Applications for Corporate Security
• A Real Application: Using OSINT to Investigate a Company

The Anatomy of Corporate Security

Let's start by understanding that corporate security and cybersecurity are closely related but distinct areas. Both fields aim to protect an organization's assets, operations, and reputation but have different focuses. Cybersecurity is all about defending digital assets and data from online threats, while corporate security has a broader scope, covering:

Physical Security. This subcategory is all about the real-world things surrounding an organization. The corporate premises, facilities, and events are covered within. The goal is to prevent trespassing, theft, vandalism, and other physical threats. This might be achieved via access control systems, safety personnel, surveillance cameras, and emergency response plans.

Intellectual Property Security. Here, the spotlight safeguards a company's sensitive information, including trade secrets, patents, trademarks, and copyrights. This subcategory of safety involves preventing illicit access, sharing, or theft of valuable intellectual material. To enable this, a combination of digital and physical safety measures are employed, with a focus on data access.

Financial Security. This category protects an organization's economic assets, transactions, and records. Measures such as due diligence checks on business partners, clients, employees, and suppliers are critical tactics for the field. In addition, other vital elements are countermeasures against fraud, money laundering, and asset mismanagement to prevent hefty fines and compliance issues.

Human Asset Security. This area zeroes in on the well-being and safety of an organization's most valuable resource—people. Human asset security involves comprehensive background screenings, security protocols to prevent workplace violence, worker welfare during business trips, and a system for guarding sensitive employee personal information.

Key Challenges of Corporate Security in 2023

Organizations face various obstacles to keeping their businesses safe with the world's shifting landscape. Let’s take a closer look at them.

Bring Your Own Device (BYOD) System

Following the COVID-19 pandemic, the corporate world saw significant shifts in day-to-day operations. As more companies switch to remote work, employees have started using their personal devices not only for leisure but for business goals as well. According to a CheckPoint report, 57% of organizations have implemented some form of long-distance work, along with BYOD, which creates particular challenges for safety teams.

• Device Security. Let’s face it: when getting a new laptop, most people don’t rush to install the latest anti-virus software. Now imagine a device is vulnerable to outside threats and it has access to sensitive company documents. Scary, huh? This “I’ll handle it soon” attitude is the leading cause that organizations face when implementing a BYOD system. Risks such as device theft, data leaks, and malware attacks rank as potential severe disasters in a remote work situation.
• Security Awareness. While proper malware protection is essential, it’s not the only line of defense for laptops and smartphones. Nothing beats having a good understanding of device safety principles. Sadly, many employees lack the technical know-how to protect company files from malicious actors. According to a global Statista survey, device and credential safety is still a leading cause of concern for Chief Information Security Officers (CISOs) in 2023.

Insider Threats

Companies try to adjust to the turbulent industry changes, sometimes resulting in substantial workforce adjustments. Studies report that mass layoffs can result in severe corporate security risks where angry employees leak sensitive documents. According to Palo Alto Network’s report, 75% of insider threat-related cases involve former employees unhappy about their termination.

OSINT Applications for Corporate Security

Companies encounter diverse risks from multiple sources, including envious competitors, desperate former employees, or malicious hackers. These threats affect both the digital and physical security of organizations. Luckily, OSINT can provide valuable assistance in mitigating these risks, and here are some of the methods:

Threat Intelligence. Imagine we work for a central bank and regularly monitor illicit Dark Web forums with the help of open-source intelligence tools (see seven robust solutions in a dedicated post). One day, we encountered discussions where hackers planned an attack on our bank. Rather than panicking, OSINT solutions equip us with a vital early warning. This information empowers our cybersecurity team to reinforce the company's defenses and prevent the impending attack.

Vulnerability Assessment. Let’s say we’re IT experts working for a healthcare company. We discovered that, somehow, threat actors leaked our firm’s medical research documents online. Such situations are very concerning for a company’s operations. Using OSINT tools, we can address security vulnerabilities and proactively prevent sensitive information from being compromised.

Employee Security. Here's a common scenario: an HR manager discovers that one of the employees has been posting the company's sensitive info on social media to sell it. With the help of OSINT solutions, the organization can quickly identify everyone associated with the illicit plan and avert the potential disaster.

Incident Response. Suppose an e-commerce company notices online discussions about a recent data breach affecting their website. Thanks to this early detection, the firm’s incident response team can investigate the leak, patch the vulnerabilities, and notify affected customers promptly, minimizing the damage.

Brand Protection. Let’s consider a situation where the marketing team faces tons of negative comments about the quality of the firm’s latest product. This might be possible due to sentiment analysis and built-in hate speech detection in OSINT solutions. Well-timed monitoring allows the team to respond to such comments quickly, address customer concerns, and manage the brand's reputation by adjusting the product's quality. 

Due Diligence. In such situations, OSINT is a must-have tool to avoid unwanted risks. For example, let’s say that an organization is hiring a new executive for a company. The experts use open-source intelligence to analyze the candidates' entire backgrounds, as well as their professional and financial histories. During the investigation, the specialists uncover shadow ties linking the potential candidate to money laundering operations and decline the executive-to-be.

Competitor Intelligence. OSINT tools are an excellent solution for conducting in-depth competitive analysis and market research to develop or adjust current strategies. Unlike manual methods, ML-powered features allow one to monitor the whole media field, including social media, customers' preferences, current trends, or public discussions. Insights gained can help businesses find market gaps and emerging opportunities, detect competitors' weaknesses, and make more informed decisions regarding further strategies.

A Real Application: Using OSINT to Investigate a Company

Let's illustrate the impact of due diligence on corporate security with a practical example. Imagine our company has received a partnership offer from another organization, MineCorp. While this opportunity seems promising, we must conduct a background check to assess potential risks, including corruption, money laundering, and compliance issues. To do this, we'll utilize an all-in-one OSINT solution, SL Professional.

The first step is to create an entity named MineCorp. We check the company's name in reputable journalistic sources like the Organized Crime and Corruption Reporting Project (OCCRP) to investigate corruption and compliance issues. For this, we use the [OCCRP] Search Documents transform to determine if the corporation has faced any legal problems.

Next, we run several transforms, including [Offshores] Search, [Opencorporates] Search Companies, and [LinkedIn] Search, to gather information about MineCorp's structure, legal status, and key personnel. Listed methods allow us to monitor official governmental filings, making them valuable resources. At this stage, we find a history of environmental violations, corruption investigations, and government interventions at MineCorp. And the central figure of this parade is the CEO, Claire Montauk. 

So, our next step focuses on the allegedly corrupt executive of MineCorp. We run the Search by Name and Face transform using her name as an entity and an official photo from the company website. As a result, we found her LinkedIn profile. Then we run [LinkedIn] Get Details to get her account details and connections. And here's the moment of truth—we reveal that Claire Montauk has ties to organizations that have been heavily investigated for corruption and environmental abuses.

Armed with this information, we promptly informed our company's board of executives. We explained the problematic history of MineCorp, as well as the troubling connections of their Chief Executive. Consequently, our organization's decision-makers canceled the proposed partnership to avoid potential complications.

A quick recap of the process:

• First, we examined journalistic sources for signs of corruption or criminal activity. 
• Then, we delved into MineCorp's legal filings to identify key personnel. 
• After, we conducted an in-depth search to uncover any scandals or negative news about the company or executives.
• Finally, we conducted a background check on MineCorp’s CEO and uncovered ties to risky individuals and organizations.
• Thanks to the thorough due diligence process, our firm made an informed decision to decline the offer, preventing potential issues.

And that concludes our article about using OSINT in corporate security. We hope you’ve gained an educated overview of the many emerging problems experts are dealing with and see how open-source intelligence can help prevent potential disasters.