The dark web is a popular topic at the moment, especially with the rise in speculation amongst cybersecurity specialists about the future of dark marketplaces. Nevertheless, it’s also important to remember that criminal activity isn’t limited to just the dark web; it’s an internet-wide problem. As the years continue, cybercrime analysts are expecting upticks in malicious activity on the open web too. But before we get into details, let’s take a quick topographical view of the internet.
What is the “Dark Web”?
Most of us think of the “surface” or “open” web when discussing the internet. This is the layer of the internet that is indexed by search engine browsers (i.e. Google, Firefox, Internet Explorer). However, this portion of the web accounts for only a microscopic amount of the activity online.
The next layer of activity happens on the huge level called the “deep web”, where databases of “secure” information like financial records, medical records, and government resources are accessible through client portals or gateways. It’s these accounts that are all too often breached, and there’s plenty of material to access, with the deep web existing as an estimated 40-500 times larger than the surface-level web we so commonly use.
The final section of the internet is called the “dark web”. These are the websites that are purposefully concealed from the rest of the internet and are usually only accessible through particular web browsers like Tor. This is where most of the heavy-duty criminal activity happens, amongst a large underground economy consisting of illegal goods, compromised data, malicious software, and cybercrime tools, as well as information for executing successful cyber attacks.
Why Can’t We Just Delete the Dark Web?
So why not just wipe out the dark web completely, you ask? Well, it’s important to realize there are legitimate reasons for using the dark web as well. For instance, citizens under oppressive regimes use the dark web to access information that is freely available to others, and journalists and whistleblowers can communicate privately with anonymous sources.
Even though the dark web isn’t the only spot for illegal, online trade, it’s valuable to understand how cybercriminals do what they do. Law enforcement uses this intelligence to successfully bring down the dark web markets and create a rippling effect of fear and mistrust. Unfortunately, cybercriminals are utilizing alternative methods to conduct business as a result. Many of them are mainstream communication paths like Jabber and Skype, along with forums dedicated to hacking and code repositories.
How to Plan for Cybercrime as a Business
Although it may be tempting for business owners to take it upon themselves to determine the extent of their information exposed and seek retribution, engaging in such activity can be more of a risk. It’s better to plan for data breaches using threat modeling and leave the rest up to cybersecurity professionals.
Cybersecurity Threat Modeling is an iterative process that needs to be updated whenever there are substantial changes to either assets or threats. Typically, the process consists of:
1. Define your business assets – Critical business processes, high-value systems, intellectual property, etc.
2. Identify which systems hold the assets – Databases, servers, email, calendars, network, CRMs (Custom Relationship Management software), and more.
3. Create a security list for each system – Includes which security controls are currently used to protect those systems in step #2 (i.e. enterprise-grade firewalls, solid endpoint detection and response systems, or the best antivirus). List any known vulnerabilities that are present as well.
4. Identify any potential threats – Hacktivists, cybercriminals, the competition, disgruntled employees, customer theft, etc.
5. Prioritize the potential threats and take proactive action to lower the risks – Consider any past data breaches, as well as internal risk concerns, and attempt to foresee what the organizational impact of particular threats could be. How would you react to a breach with each potential threat? What would be the best way to mitigate these risks right now?
With a threat model in place, you can match the highest severity risks to appropriate tactics, techniques, and procedures. By establishing these threat profiles in your business, it helps CEOs to understand where their computer security is lacking and how the improvements need to be made. As a result, threats are mitigated with a stronger defense.
If you’re a business owner who is concerned about the state of your technology’s security and how your business would survive a devastating cyber attack, contact us at (860) 785-6233. Encompass IT Solutions provides in-depth Cybersecurity Risk Assessments that identify and mitigate cybersecurity threats for your computers and network infrastructure.