Information Security: Litter

July 22, 2010

One routine I have always made sure I follow on every protection assignment and on my own travels is information security by the removal and later destruction of litter. Most people will have some sort of understanding of protecting the client’s room number and personal details by booking under another name, diverting calls and screening mail. However, you should take this one step further by ensuring no schedules, flight stubs, receipts, letters, personal note’s or check in information is left in the room or vehicles. This includes both when you are checking out and during your stay where information is in view for cleaning staff and drivers.

Although this information may seem mundane, but in the wrong hands it can be used to embarrass or gain access to your client or even threaten their safety. By making it a habit to fully check rooms, including clearing out of bins of any litter, you will ensure that you are leaving nothing easily assessable to the wrong people. You are also making sure you do not leave any stray items behind, leaving you or your client ill prepared for your next hotel stay.

Most people don’t give much thought to what they are throwing out or leaving for someone else to dispose of.  Paying of hotel cleaners or dumpster diving can lead to a wealth of information about an intended target.  These pieces of information coupled with corporate profiles, tour date, social media accounts (Twitter, Facebook) websites and other open source information can lead to a detailed profile on your client and their future movements be formulated. Although you cannot control all aspects of information regarding your client you can make access to that information and the formulation of the larger picture more difficult and ineffective.

A good book to read on social engineering and the use of piecing together a larger picture through small pieces of information is “The Art of Deception” by Mitnick / Simon. Even though I have always taken information security seriously it wasn’t until I read this title that I realized I may myself unwittingly been engineered to disclose information I thought of no importance in the past.

Damon

Filed under: Uncategorized

Tags: Information Security, Protection, Social Engineering