It’s too late for a Halloween story, but year-round, it’s the things in the dark that scare us. This is true in the online world as much as the real world.

The Dark Web Defined

The web lets us instantaneously access information and resources all around the world by typing a URL into a browser, but there’s a part of the web that’s not easily accessible. URLs that aren’t known to the search engines are called the deep web, and much of that is innocuous, such as pages under development that aren’t yet released to the public. A small corner of the deep web is the more dangerous dark web, where anonymity is preserved and criminality thrives.

The dark web is a vibrant marketplace, filled with stolen data (account numbers, social security numbers, passwords, and other personal information) and tools for hacking. When a data breach occurs, it’s often made possible by malware sold on the dark web, and the stolen data often ends up for sale there, as well. For all the value this data has to its owners, there’s so much of it that it’s cheap for criminals to buy: according to Experian, social security numbers sell for just one dollar.

Dark Web Dangers for Business

As both the source of hacking tools and the destination for stolen data, the dark web is a threat to data security. The dark web is also an inspirational source for criminals. There are those hacking kits that are available, plus guides on how to deploy malware and ransomware, and how to open fraudulent accounts. Wannabe criminals who don’t have their own technical skills can rent a botnet to execute a DDoS attack or buy admin credentials to gain access to a company’s systems.

It can be used in other ways to harm businesses, too. There are sites that aggregate personal information—not just your accounts but also your social media—that can be used to threaten executives.

Learn more in What is the Dark Web and Why Should We Care?

Shine Light into the Dark Web

For businesses to protect themselves against the dark web’s dangers, the first step is to know when the dark web is brushing up against them. Monitoring tools allow companies to detect if any data stolen during a breach has been made available on dark web sites. You can make sure the data is yours through watermarking or fingerprinting.

In addition to monitoring for data from your business, you should also monitor the dark web for references to your business, including names of employees. Monitor for references to specific software and hardware you use, as that chatter can reveal vulnerabilities and potential attacks.

Beyond monitoring, make sure you have a strong cybersecurity process in place. Ensure patches are applied quickly, firewall rules are correct, and consider intrusion detection and data loss prevention software to help prevent theft of data. Make sure your employees are trained to detect phishing emails and to use safe computing practices such as strong passwords.

CCS Technology Group provides security services to help businesses against the dangers of the dark web. Get a dark web scan to learn how to stay safe at Halloween and year round. What you don’t know will hurt you. A Dark Web Scan can uncover if your data is for sale, and tell you if your personal or business data may be at risk.

Additional Cybersecurity Resources

Create An Information Security Culture to Protect Your Data

6 Ways to Keep Your Cloud Secure

The cybersecurity employee training checklist

You’re happily humming along on the internet, thinking you’ve got a pretty good understanding. You can navigate your way around Google, Facebook, Amazon, and news sites. You’re actually only visiting four percent of the internet. There’s a whole world hiding beyond these safe surface-level sites, known as the Dark Web and it’s a much less hospitable place.

What exactly is the Dark Web?

The Dark Web is a conglomeration of websites that cannot be found on search engines or accessed via traditional web browsers because their location and identity is hidden through encryption tools such as TOR. TOR was originally created to protect military communication but now has a much broader utilization for both Dark Web purposes and highly secure communication. You typically have to access Dark Web sites utilizing TOR.

People create sites on the Dark Web in order to hide where they’re operating from, as well as to remain anonymous (TOR hides all IP information, identifying information, as well as data transfers). Over half of the sites on the Dark Web are used for criminal activities.

Why Do People Use the Dark Web?

One of the most prevalent uses of the Dark Web is buying and selling illegal goods, such as recreational drugs, weapons, fake identities, and organs. The proliferation of cryptocurrencies—like Bitcoin—has facilitated these sales. People living within totalitarian societies that restrict communication also take to the Dark Web to share their thoughts freely.

The most dangerous use of the Dark Web for businesses is the exchange of credentials (usernames and passwords) and identities. An individual’s stolen credentials can typically be sold on the Dark Web for as low as $1. Hackers utilize these purchased credentials to:

• Gain access to important financial information and steal identities (access to a Bank of America account holding $50,000 can be purchased for $500)
• Access accounts for further phishing attacks
• Threaten people with exposure of sensitive information (Remember the Ashley Madison hack from a few years back? Those credentials were dumped onto the Dark Web and hackers leveraged them to expose users).
• Compromise other accounts using the same passwords and perpetuate the sale of personal Information

What can you do about it?

The average citizen will never have a reason to access the Dark Web, but their credentials could easily be floating around, endangering their offline livelihoods. Once your credentials are released on the Dark Web, there is precious little you can do to have them removed. However, you should, at the very least, know when you’ve been compromised so that you can immediately act, like changing your passwords and activating two-factor authentication.

We recommend utilizing a full Dark Web monitoring service that alerts you if credentials appear on the Dark Web. These services constantly scan the Dark Web for your information and alert you whenever something suspicious appears. These alerts don’t necessarily mean a breach has occurred, but they are very good heads up that something bad may be coming. You can then create a plan of attack before any damage is done. Granted, there will be your fair share of false positives, but we firmly believe in operating in the better safe than sorry camp.

How should you get started with Dark Web monitoring?

Our team can run a preliminary scan of your domain revealing the likely breaches in the last 36 months. We’ll then review that report with you and come up with a plan of action to alleviate any major dangers. Click here to request a free dark web scan.

Or learn more in our other article Discover the Dangers of the Dark Web.

Additional Dark Web Resourcs:

What is the Dark Web & How to Access it

Battling the dark WEB

What is the dark web? How to access it and what you’ll find

Dark web data monitoring: 6 questions to ask

Who do you rely on to keep your data safe? If your answer is your information security team, you’re only half right. Because everyone can cause a security incident (and insiders, either accidentally or deliberately, are the biggest cause of data breaches), information security is everybody’s job. Making everyone realize that requires deliberately creating a culture of information security.

Obstacles to a Security Culture

There are two main obstacles to creating a security culture: your management and your employees.

Management often gives lip-service to the need for information security, but doesn’t practice what they preach. Executives are likely targets for phishing attacks, but they’re often exempt from security awareness training. Many still share passwords and rely on administrative staff to generate reports and access online systems for them.

Employees see management not practicing safe computing, and reasonably conclude it isn’t really a top priority. The security training they receive is often boring or superficial. Their direct managers often emphasize getting the work done, even if it means taking security shortcuts.

Both managers and employees usually understand information security to mean technology that prevents data breaches. Building a security culture means changing that understanding; if you define information security as being about reducing risk rather than preventing a breach, it is easier to see how it’s everyone’s responsibility.

Learn more in Don’t Let These Obstacles Get in the Way of Your IT Security.

Talking About Information Security Is Key

Although much security training is ignored by employees, having conversations about security is key to changing awareness and attitudes. Look into new ways to make training for interesting and more impactful; the “gamification” of training rewards employees for the effort they put into it.

It’s also important to not only teach employees about strong passwords, but explain why they matter: what are the risks and consequences when poor security practices enable a breach. It also requires having a clear process by which employees can report suspected phishing attempts or other security incidents.

In addition, provide tools and processes that help employees use safe computing practices—but use them wisely; restrictions in places where they don’t really make sense will lead to employees searching for workarounds. Have a strong password policy, and give employees access to a password manager so they don’t write them down. Make sure you have an efficient process to grant employees access credentials so they don’t need to share them.

Learn more in The cybersecurity employee training checklist.

Security Isn’t One and Done

The most important way to make security a part of your culture is to make it clear that it’s an ongoing process—employees haven’t fulfilled their security responsibility simply by attending a once-per-year presentation. Have fun quizzes and security tests throughout the year, with rewards for employees who do well or who report potential incidents.

Make your security culture even more effective by deploying security tools that support safe computing practices and reduce the number of threats that get near your employees. CCS Technology Group provides security services that help employees keep your data safe. Contact us to learn more.

Additional Cybersecurity Resources

The Key Features to Look for In Your Firewall

6 Ways to Keep Your Cloud Secure

Closing the Most Common Cybersecurity Holes