Footprinting can be a powerful tool in the hands of an attacker who has the knowledge and patience to dig up the information that is available about any entity online. Although footprinting is a powerful tool, there are some countermeasures that can lessen its effect to varying degrees.

Here are some of the defenses that can be used to thwart footprinting:

• Website—Any organization should take a hard look at the information available on the company website and determine whether it might be useful to an attacker. Any potentially sensitive or restricted information should be removed as soon as possible along with any unnecessary information. Special consideration should be given to information such as email addresses, phone numbers, and employee names. Access to such information should be limited to only those who require it. Additionally, the applications, programs, and protocols used by a company should be nondescript to avoid revealing the nature of services or the environment.

• Google hacking—This attack can be thwarted to a high degree by sanitizing information that is available publicly wherever possible. Sensitive information, either linked or unlinked, should not be posted in any location that can be accessed by a search engine, as the public locations of a web server tend to be.

• Job listings—When possible, use third-party companies for sensitive jobs so the organization’s identity is unknown to all but approved applicants. If third-party job sites are used, the job listing should be as generic as possible, and care should be taken not to list specific details or versions of applications or programs. Consider carefully crafting job postings to reveal less about the IT infrastructure.

• Domain information—Always ensure that domain registration data is kept as generic as possible and that specifics, such as names, phone numbers, and the like, are avoided. If possible, employ any one of the commonly available proxy services to block the access of sensitive domain data. An example of one such service is shown in FIGURE 5-15.

• Personnel social media posts—Be especially vigilant about information leaks generated by well-intentioned personnel who may post information in technical forums or discussion groups that may be too detailed. More important, be on the lookout for personnel who may be disgruntled and may release sensitive data or information that can be viewed or accessed publicly. It is not uncommon for information leakage to occur around events such as layoffs, mergers, or contract terminations.

• Insecure applications—Make it a point to regularly scan search engines to see whether links to private services are available (Terminal Server, Outlook Web App [OWA], virtual private networks [VPNs], and so on). Telnet and FTP have similar security problems because they both allow anonymous logon and passwords in cleartext. Consider replacing such applications with a more secure application, such as Secure Shell (SSH) or comparable wherever possible.

• Securing DNS—Sanitize DNS registration and contact information to be as generic as possible (for example, “Web Services Manager,” main company phone number 555-1212, [email protected]). Have two DNS servers—one internal and one external in the demilitarized zone (DMZ). The external DNS should contain only resource records of the DMZ hosts, not the internal hosts. For additional safety, do not allow zone transfers to any IP address.