Analyze presence of outsourced capabilities

From pre-attack
Jump to: navigation, search


Analyze presence of outsourced capabilities
Technique
ID PRE-T1080
Tactic Organizational Weakness Identification

Definition

Outsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing.12

Difficulty for the Adversary

Easy for the Adversary (Yes/No): Yes

Explanation: Analyzing business relationships from information gathering may provide insight into outsourced capabilities. In certain industries, outsourced capabilities or close business partnerships may be advertised on corporate websites.

Detection

Detectable by Common Defenses (Yes/No/Partial): No

Explanation: Much of this analysis can be done using the target's open source website, which is purposely designed to be informational and may not have extensive visitor tracking capabilities.