Company leaders are familiar with a growing list of cyber threats, from phishing to ransomware. Most are less familiar with another area of cyber-related risk, and even those who have heard about it may incorrectly assume it doesn’t pose a threat to their companies’ well-being.
That area is what’s known as the Dark Web. We’re all familiar with the internet, and we know that search engines like Google allow us to see and catalog information that’s in cyberspace. But there are a couple of corners of cyberspace the search engines can’t reach. One, often referred to as the Deep Web, is information that’s stored in private networks and similar spaces, such as medical and financial records. While it’s accessible to people who have the right credentials, the rest of us can’t see it.
The dark web is also invisible to search engines and ordinary reasons, but for nefarious reasons. The people and organizations who use the dark web are doing things they don’t want anyone to know about, such as criminal activities. Dark web users rely on complex networks such as Tor (an acronym for what was once called “The Onion Router”) that protect their privacy and mask their identity while they conduct activities. Common users of the dark web include terrorists, drug dealers, people trading in child pornography, and cybercriminals. (Some people use the dark web for legitimate reasons, such as someone trying to avoid a stalker or keep their life out of the eyes of a bad relationship.)
Since your company isn’t involved in any of those activities, why should you care about the dark web? It’s simple — it may be that information about you and your employees are being shared or sold. What sort of information? Everything from the names and contact information for your employees, to medical information associated with company-provided benefits, to your company’s financial data, to access credentials such as passwords and usernames for your networks and what you assumed was secure data storage. It could be sitting out there right now, and you have no way of knowing it.
In addition, people who are seeking ways to disrupt your company’s operations can find what they need on the dark web, such as tools for denial of service attacks, malware, infections, and even ransomware.
Still not concerned? Consider what happened to one company we worked with. The CFO’s email account was compromised, and deep within the stacks of old emails stored in his account was one that included scans of the signature cards for the company’s bank accounts. The cybercriminal who found those scans used them to craft physical letters with the signatures and then scanned and sent them to the bank, attempting wire fraud.
As with so many things, being forewarned is forearmed. If you don’t know what information about your company lurks out there on the dark web, it’s impossible to address it. Even knowing what’s out there is only the first step. You have to be able to determine the implications of what’s out there and learn how you can keep similar situations from happening.
The first step is what’s known as dark web monitoring. There are software platforms and online services capable of peering into the dark web and identifying what’s out there. But just like anti-virus and anti-malware systems, performing a scan gives you a one-time look. You might not find anything today, but what happens if your company is unaware of a phishing attack or a breach that occurs tomorrow? That’s why dark web monitoring needs to be an ongoing element of your online hygiene.
In the second part of this series, we’ll examine what you need to think about — and what steps you should take — once you discover information about your company on the dark web.
Do you have reason to be extremely concerned about a dark web threat, such as past problems with employee information or some kind of breach? Brightworks will be happy to perform a complimentary dark web scan of your company’s IT system. We’ll share what we’re able to find and discuss the steps you can take. There’s no cost and no obligation, so please contact us today.