Much of our perception of the dark web is limited to what we see on TV — a hub for criminals, illicit goods and illegal activity. But to understand its true impact on business, it’s helpful to demystify some of the terminology you’ve likely heard.
Imagine that the internet is an iceberg. The visible ice, above the water, is the surface web, and includes all of the websites indexed by search engines and accessible by anyone, from news and banking sites, to entertainment and brand websites.
Deep, dark and surface
The largest part of the iceberg is underwater. This is the deep web.
It’s a collection of sites not indexed by search engines, typically not for nefarious reasons, but because they’re behind a login. Examples include company intranets, private databases, medical records, scientific reports and financial transactions. You can also find private message boards or forums here; for the most part, these are also legitimate, but can be used by cybercriminals to communicate with each other or buy and sell items.
The dark web is like the bottom of the submerged iceberg.
It can only be accessed by anonymised browsers, such as TOR (the Onion Router), and typically its traffic can’t be monitored. Again, it’s not just used by criminals.
Individuals with privacy concerns, as well as journalists, use the dark web, but there is also a host of illegal activities taking place here as well: from buying and selling illegal merchandise (drugs, guns, counterfeit luxury goods), stolen credentials, pirated software and luxury counterfeit goods, to hacking tutorials and the sale of targeted cyberattacks, such as DDoS.
The threat of the dark web
So how does this apply to your business? If your business has experienced a phishing attack or data breach, the stolen data could be up for sale on the dark web.
This could include information about your business, your intellectual property, staff, payment details, etc. In addition, if staff use their work email addresses to sign up for online services and those sites are hacked, those email addresses (and potentially even passwords) could be floating around on the dark web. If your staff use the same passwords across sites, including their work emails, this makes your organisation vulnerable.
In the same vein, counterfeit products (with your brand name) could be available on the dark web. Hackers also identify vulnerable networks and create lists of IP addresses, also all available for sale in these marketplaces.
Items found on the dark web can vary, and your vulnerabilities as a brand depend on the type of industry you operate in. For example, financial institutions need to guard client account data, manufacturers protect their IP, retailers protect customer credentials and payment data, and healthcare organisations safeguard patient records.
But can you monitor the dark web when everything and everyone operating within it is anonymous? Yes, you can. You can monitor for mentions of your brand, employees or customers. If this information is found, you can evaluate what kind of data it is, what risk it poses to your organisation and you can take steps to mitigate that risk, whether that’s closing a vulnerability, changing email addresses, or notifying customers.
Find out more
In our on-demand webinar, we take a deep dive into the dark web and discuss how criminals use it. We also address the role of cryptocurrencies, threats to your business and actions you can take to mitigate risk. Watch now.
