Asset Discovery Making Sense of the Ocean of OSINT

Richard Gold addresses the complexities of external attack surface management (EASM) and open-source intelligence (OSINT), focusing on how organizations and penetration testers can make sense of vast, noisy datasets to discover exposed assets without causing operational disruptions.

[04:26] Gold highlights the critical challenge of defining and bounding scope during asset discovery. He cautions against casting an overly broad net, illustrating how overlapping corporate acronyms, subsidiaries, and third-party SaaS vendors can flood investigators with false positives. He emphasizes front-loading the discovery process by precisely verifying parent-child corporate relationships, brand names, and ASN registrations.

[18:32] The talk outlines automated telemetry collection methods, demonstrating how to harvest Certificate Transparency (CT) logs, scrape Subject Alternative Names (SANs) from SSL certificates via large-scale scanning (ZMap/Masscan), and analyze DNS records (SPF, MX, TXT) to uncover forgotten subdomains and shadow IT infrastructure. Gold introduces "Orca," an open-source tool designed to streamline asset collection and provenance tracking. He shows how Orca integrates with CVE-Search [30:55] to map discovered software versions against known vulnerabilities, allowing analysts to filter and export high-priority findings [36:57] into actionable operational spreadsheets.

(AI summary — Gemini Flash)