Mfcttrf

A young tech company which operates on sensitive data has employees that fall victim to phishing/porting scams despite its best efforts to instill security fobs, vpn, password managers, non-sms 2FA, limited email access and so on.

Is it a good practice to force employees to hide their employment status from the public to avoid being targeted for hacking (e.g. remove the employer from LinkedIn)?

Hiding your employer would not appear to be of any use at all when you want to hide the employee's email address from the public. If you hide your employer info but spread your contact details far and wide, the employer info is not interesting.

Managing digital footprint is always a good consideration but you have an awareness problem and a trust problem with your employees that such a policy is not going to address.

Schroeder's answer explains things very well, but I would like to offer a different view.

Employees will likely act online. They will ask questions on Stack Exchange, in support forums of vendors, etc.

If it's apparent whom they work for (e.g. by using the email address j.doe@awesomecorp.com), then an attacker looking to gain information about Awesome Corp will be able to gather information about systems being used by the company. Depending on how much information they (knowingly or unknowingly) expose, this may include:

• Configuration data


• Products and versions thereof used by the company


• Credentials


• Internal addresses


• Etc.

While this in itself may not directly constitute a vulnerability, it can show an attacker potential entry points and allows them to more efficiently understand the architecture of Awesome Corp.

The idea that J. Doe should hide that he is working for Awesome Corp is not necessarily useful. The problem arises when J. Doe discloses internal information.

As such, employing an information disclosure policy is very useful for the company. It should contain which information can be shared with vendors, the public, etc. In addition, employees should have someone to talk to if they are uncertain whether or not something is considered internal information.

The best security practice is to train the employees specifically to avoid phishing and scams in general. Also, you need to test them periodically, to check if they are actually reacting to scams as they were trained to do. Password managers with auto-complete functionality might also help because they can be used to detect wrong URLs before entering sensitive data on the internet. Hiding employment status seems useless to me, because its usefulness is going to be negligible compared to the best practice I mentioned above (training and testing).