Analyze presence of outsourced capabilities
|Analyze presence of outsourced capabilities|
|Tactic||Organizational Weakness Identification|
Outsourcing, the arrangement of one company providing goods or services to another company for something that could be done in-house, provides another avenue for an adversary to target. Businesses often have networks, portals, or other technical connections between themselves and their outsourced/partner organizations that could be exploited. Additionally, outsourced/partner organization information could provide opportunities for phishing.12
Difficulty for the Adversary
Easy for the Adversary (Yes/No): Yes
Explanation: Analyzing business relationships from information gathering may provide insight into outsourced capabilities. In certain industries, outsourced capabilities or close business partnerships may be advertised on corporate websites.
Detectable by Common Defenses (Yes/No/Partial): No
Explanation: Much of this analysis can be done using the target's open source website, which is purposely designed to be informational and may not have extensive visitor tracking capabilities.