Summary
Reconnaissance is the first phase of most cyber attacks. Adversaries collect information to find weak points and plan entry. This guide explains common methods and the controls that reduce risk.
What is reconnaissance in cyber security?
Reconnaissance is the systematic gathering of information about a target. Attackers profile people, systems, and networks to uncover exploitable gaps. Security teams use similar techniques to assess exposure and close issues early.
Why it matters
Early detection stops intrusions before damage occurs. Small signals often precede an attack attempt. Reducing what is visible and monitoring for probes lowers your risk.
Types of reconnaissance
Passive reconnaissance
Attackers collect public information without touching your systems. They review websites, DNS and WHOIS records, job posts, and social media. They may mine breach dumps to map emails and tech stacks.
Active reconnaissance
Attackers interact with your assets to elicit responses. They run ping sweeps, port scans, and banner grabs. They probe web apps and APIs to learn versions and misconfigurations.
Common reconnaissance methods
OSINT and data aggregation
Adversaries compile data from public sources. Examples include subdomains, cloud buckets, IP ranges, and code snippets. The goal is a coherent picture of your external footprint.
Social engineering groundwork
Email formats and org charts help craft convincing pretexts. Attackers test who replies and which inboxes bounce. They validate phone numbers with short calls or texts.
DNS, WHOIS, and certificate clues
Zone data, TXT records, and certificate transparency logs reveal assets. Misplaced records expose staging hosts or forgotten services. Consistent hygiene reduces these leaks.
Port and service discovery
Scans reveal open ports and listening services. Follow-up probes identify versions and weak defaults. Rate-limited scans help attackers avoid noisy patterns.
Network mapping and OS fingerprinting
Timing, TTL, and stack quirks hint at device types. Traceroute variants outline network paths and controls. The map guides later lateral movement attempts.
Cloud and SaaS exposure checks
Attackers look for public storage, test keys, and over-permissive roles. They also review CI/CD endpoints and status pages. Shadow IT widens the attack surface.
Indicators of reconnaissance activity
Network-level signals
Short bursts of SYN packets across many ports suggest scanning. Repeated 404 or 403 codes on odd paths can indicate cataloguing. Geographically diverse probes in tight windows are suspect.
Host and user signals
Unusual authentication attempts against disabled users are a red flag. Repeated requests for non-existent files imply content discovery. Staff receiving odd validation emails is another sign.
Defences that work in practice
Reduce the attack surface
Inventory internet-facing assets. Remove orphaned hosts and default pages. Enforce least privilege for cloud roles and service accounts.
Detect and disrupt
Enable IDS or NDR to alert on scan patterns. Rate limit and tarpitting slow indiscriminate probes. Use deception assets like low-interaction honeypots to trip alarms.
Control exposure at the edge
Apply deny-by-default firewall policies. Filter management ports from the public internet. Place WAFs and API gateways in front of critical apps.
Hardening and patch discipline
Close unused ports and disable weak ciphers. Patch exposed services on a routine cadence. Replace default banners and suppress verbose error messages.
Segment and authenticate
Use network segmentation to constrain movement. Require MFA for admin paths and remote access. Isolate backups and monitoring from user subnets.
Monitor and respond
Aggregate logs in a SIEM for correlation and alerts. Track baselines for traffic and authentication. Rehearse playbooks for scan and probe scenarios.
Comparison Section
| Approach | Key features | Best for |
| External attack surface management | Continuous asset discovery, exposure checks | Finding unknown internet-facing assets |
| IDS/IPS or NDR | Signature and behaviour detection, blocking | Spotting scans and lateral recon |
| SIEM with UEBA | Log aggregation, anomaly detection | Correlating weak signals across systems |
| Vulnerability scanning | Port and service mapping, CVE checks | Prioritising patching on exposed hosts |
| Deception technology | Honeypots, honey credentials, alerts | Early warning with low false positives |
| Microsegmentation | Policy per workload, east-west control | Limiting blast radius and movement |
Conclusion
Reconnaissance thrives on visibility and silence. Shrink what attackers can see and raise fast, accurate alerts for what they try. Combine reduction, detection, and response to break the kill chain early.
Related reading: Nmap vs Masscan.
FAQ
Is reconnaissance illegal?
It depends on intent and permission. Testing your own assets or with written consent is acceptable. Probing others without consent can breach laws and terms.
How do I detect port scanning in time?
Alert on rapid or distributed SYN attempts and connection failures. Correlate with unusual user agents, geographies, and denied paths.
What is the difference between reconnaissance and scanning?
Reconnaissance is the broader information-gathering phase. Scanning is one active technique used within that phase.
How often should we scan our external footprint?
Run continuous discovery where possible. Supplement with weekly reviews and deeper monthly assessments.
Which ports should never be exposed publicly?
Avoid exposing administrative services like SSH, RDP, WinRM, and database ports. Use VPNs, jump hosts, or zero trust access instead.
Do small organisations need deception tools?
Not always. Start with inventory, patching, MFA, and logging. Add deception when basics are stable and coverage is strong.
What metrics show improvement against recon?
Track unknown-to-known asset ratio, time to close exposures, scan alert fidelity, and repeat probe rates by source.
