Critical infrastructures such as energy, transportation, water, and communication systems represent the backbone of modern society, and their security is of paramount importance. At the same time, a vast amount of information about these infrastructures is publicly available through online sources, ranging from official websites and government databases to social media, satellite imagery, and leaked datasets. This type of data, known as Open Source Intelligence (OSINT), is increasingly used not only by researchers and security professionals but also by malicious actors who may exploit it to identify vulnerabilities and plan attacks. Understanding the scope and depth of OSINT relevant to critical infrastructures is therefore an essential step in assessing their exposure and resilience in the information age.
The aim of this thesis is to conduct a comprehensive exploration of OSINT tools and methodologies in the context of critical infrastructures in Norway. By systematically applying a wide range of open-source frameworks, platforms, and analytical techniques, the study will map out what types of information can be collected, how it can be correlated, and what potential risks such data could pose if misused. The focus will not be on exploiting identified weaknesses, but on surveying the landscape of OSINT capabilities and reflecting on their implications for security and risk management. The outcome will be an overview of current OSINT practices, their limitations, and recommendations for how operators of critical infrastructures can better understand and mitigate their publicly observable exposure.
The thesis is supervised together with the Norwegian Defense Cyber Academy. Due to regulatory and project-specific requirements, applicants holding citizenship from certain countries are regrettably not eligible for this thesis topic.