DARK WEB MONITORING SERVICES

What is the dark web used for?

The dark web is a part of the internet that includes sites that are not indexed by commonly used search engines, such as Google. They are accessible only through anonymized software like the browser Tor or I2P, which uses a distributed network database. Users are thus able to maintain their confidentiality: both their identity (IP address), and the websites they choose to visit.

These characteristics make the dark web attractive to cybercriminals, who use it for illicit activity such as selling drugs, weapons and malware. They share information, develop and coordinate cyber attacks, negotiate Ransom as a Service (Raas) transactions, and sell confidential information.

Groups motivated by ideology, whether political, social, environmental or other, are also known to have used the dark web to plan and coordinate demonstrations or attacks on organizations they perceive as adversaries.

It should be noted, however, that the dark web is also used for non-criminal activity, for example, by journalists who must protect their identity in countries that do not respect privacy and allow free speech.

What types of information are sold on the dark web?

On the dark web, cybercriminals share and sell information that they have obtained by breaching targeted organizations’ systems (for example, credit card information, personally identifiable information (PII), login credentials, financial information, medical records and more). The perpetrators are often motivated by the prospect of financial gain – either by selling the stolen information or using it to extort its original owners.

What is dark web monitoring?  Is monitoring of the dark web necessary?

Dark web monitoring is essentially a continuous search of the dark web with the aim of detecting threats. Given the enormous amount of information found on the dark web, in order to yield effective results, the monitoring must be as precise as possible, using keywords and terms that are specific to the information sought. When the languages relevant to the organization that has engaged a dark web monitoring service provider are also taken into consideration in the search parameters, as ACID does, the results are even more accurate, and therefore, more actionable.

The importance and necessity of dark web monitoring lies in its ability to detect threats – those that are emerging, and those that have already materialized and caused damage to the targeted organization. Knowledge is key here: An organization that receives real-time alerts to threats, such as information about a cyber attack being planned against it along with all available details, can act upon this information and take the necessary mitigation steps. Also, an organization that learns that its data has been compromised and is posted on the dark web can investigate how, when and by whom it had been stolen. Often, this will point to a security gap in its systems that it is unaware of, one that possibly occurred weeks or months earlier and may still require closing to prevent further data leakage. Knowing which data has been compromised also allows taking action to lessen the harmful consequences of the breach. Providing these real-time actionable alerts and information is precisely what ACID does.

Does my organization need dark web monitoring?

Any organization whose operations involve sensitive or confidential data – for example, client and/or employee information or personally identifiable information (PII), develops products, has trade secrets, owns intellectual proprietary, or is obligated to meet regulatory and legal requirements, can be attractive to cybercriminals. As at least one of the above, often more, apply to virtually any business or organization, the answer is yes, your organization would be well advised to favorably consider dark web monitoring.

What are the features one should consider when choosing a dark web monitoring service?

When choosing a dark web monitoring service, one would be well advised to consider the following features:

• Extent of coverage – the broader the range of dark web sources that are scanned, the better, as this increases the chances of detection. It’s important to verify that the monitored sources include marketplaces at which stolen information is offered for sale.
• The information that is sought – it is imperative to include types of information that the user considers sensitive, for example, personally identifiable information (PII), and where transactions take place – credit card information. Other types of information are also highly sensitive, for example, medical records, including anamnesis, test results and details of treatments, which are stored by healthcare facilities to enable providing proper and timely medical care to patients. Where research and development activities take place, as well as in the manufacturing sector – intellectual property and trade secrets are critical not only to competitiveness and success; if compromised, this might even place an organization’s continued operation at risk.
• Quick alerts – receiving alerts as soon as possible after information pointing to an attack is detected on the dark web increases the targeted organization’s chances of stopping the spread of the sensitive information and the escalation of the attack, and reduce the extent of damage caused.
• Precise alerts – alerts that provide the targeted organization with as many details as possible about the attack and its consequences allow implementing effective countermeasures.

What’s the benefit of automating dark web monitoring?

Automated dark web monitoring allows businesses and organizations to rest assured that the monitoring activity takes place without requiring them to dedicate costly manpower resources to conduct the monitoring manually. They thus ensure that their risk of a cyberattack is mitigated, and their chances of detecting malicious activity directed against them increases. ACID’s high-quality dark web monitoring service is automated, continuous and cost-effective.