How sharing a little data can mean big trouble

Employees sharing small amounts of information on the internet, even on sites such as LinkedIn, can reveal confidential information about a company that it might not want in the open.

So warns Herbert Thompson, chief security strategist at People Security, who was speaking at one of the first RSA Conference keynotes in London about the dangers of employees giving away "gateway data".

Gateway data, he said, is data that seemed harmless, but when used properly, can facilitate access to highly sensitive information.

One way to collect gateway data was by what Thompson called "collective intelligence" the process of collecting information from a number of employees to uncover sensitive information.

"This is the data that can be gleaned from a bunch of different sources," said Thompson. "All of the data seems completely harmless, nothing interesting, but when you correlate it across a group then it becomes really interesting."

Thompson described the information you could glean from a company by noticing, for example, the top five executives all in the last month having 10 new recommendations on LinkedIn.

He said that he has conducted security research with university students on how LinkedIn recommendation requests correlated with bad things happening to a company, and said it was "incredible" how well they matched.

"It probably says they are looking for a job," said Thompson. "It probably says something about the stability of that company. Or maybe it says that the company is about to be acquired."

He added: "If you know something strange is happening with a company, people will naturally take steps to prepare themselves from when they are going to be in the job market."

He also revealed that messages on social networks such as Twitter could also reveal more information about who the customers of a business were, or what agencies they were working with.

He used an example of a message by an employee left on Twitter saying that he was flying to Bentonville in the US for a business trip.

On first glance, that message didn't really reveal much information as it was a tiny and rather boring town, but as there was only one company that was based there, it revealed what company the employee was meeting with, which was Wal-Mart, according to Thompson.

He said: "It's the world headquarters for Wal-Mart. In some cases that wouldn't be a big deal, but in some companies and some circumstances, that is a game changing piece of information."