How Does the Dark Web Impact Your Organization?
Identity theft is an unfortunate occurrence that is all too familiar to many people, but do those individuals know where the compromised data will end up? Often, these victims are unaware of the virtual marketplace where stolen data is purchased and sold by cybercriminals; a place known as the “Dark Web.” An interesting article on Lexology.com explores what the Dark Web is, what information is available for purchase there and how it impacts small businesses and organizations.
What is the Dark Web?
The Dark Web, which is not accessible through traditional search engines is often associated with a place used for illegal criminal activity. While cybercriminals tend to use the Dark Web as a place to buy and sell stolen information, there are also sites within it that do not engage in criminal activity. For many, the most appealing aspect of the Dark Web is its anonymity.
What is for sale on the Dark Web?
Information sold on the Dark Web varies. It includes items such as stolen credit cards, stolen account information from financial institutions, forged real-estate documents, stolen credentials, and compromised medical records. Even more alarming, the Dark Web contains subcategories allowing a criminal to search for a specific brand of credit card as well a specific location associated with that card. Not only can these criminals find individual stolen items on the Dark Web, but in some cases, entire “wallets” of compromised information are available for purchase, containing items such as a driver’s license, social security number, birth certificate, and credit card information.
What is stolen personal information used for?
When stolen information is obtained by criminals, it can be used for countless activities like securing credit, mortgages, loans, and even tax refunds. It is also possible that a criminal could create a “synthetic identity” using stolen information and combining it with fictitious information, thus creating a new, difficult to discover identity.
Why are stolen credentials so valuable?
Stolen user names and passwords are becoming increasingly popular among cybercriminals, but why? Identity thieves will often hire “account checkers” who take stolen credentials and attempt to break into various accounts across the web using those user names and passwords. The idea here is that many individuals have poor password practices and are using the same user name and password across various accounts, including business accounts such as banking and eCommerce. If the “account checker” is successful, the identity thief suddenly has access to multiple accounts, in some cases allowing them the opportunity to open additional accounts across financial and business-horizons.
Why should small businesses and organizations be concerned about the Dark Web?
Since the Dark Web is a marketplace for stolen data, most personal information stolen from small businesses and organizations will end up there, creating major cause for concern. With the media so often publicizing large-scale corporate data breaches, small businesses and organizations often think they are not a target for cybercriminals, however that is not the case. Cybercriminals are far less concerned about the size of a target than they are with how vulnerable their target is. Organizations and small businesses often lack resources or choose not to engage them to effectively mitigate the risks of a cyberattack, making them a prime target for identity theft as well as other cybercrime.
At a recent Federal Trade Commission (FTC) conference, privacy specialists noted that information available for purchase on the Dark Web was up to twenty times more likely to come from a company who suffered a data breach that was NOT reported to the media. The FTC also announced at the conference that the majority of breaches investigated by the U.S. Secret Service involved small businesses and organizations rather than large corporations.
How can you reduce the risk for your small business or organization?
To reduce the risks of a cybercriminal gaining access to your private information/network, you must ensure you have proper security measures in place. The FTC has a webpage that can assist with security options for entities of any size. In addition, it is crucial that your employees are properly trained on security, including appropriate password practices. There is also talk of a government-led cyberthreat sharing program which would help enhance security across all industries by sharing cyberthreat data.
Why is training employees important?
Employees are our biggest asset, but they are also our weakest link, when it comes to protecting networks and data. An IBM study found human-error accounts for a staggering 95% of security incidents. A survey by ESET on cybersecurity training found that employees said their organizations were providing them absolutely no training and only 17.9% felt they were being given ‘a lot’ of cybersecurity training. That is scary to know in a world of continuous cyberthreats, especially when it comes to HIPAA, ePHI, and PII.
So how do we address this and make your weakest link, your best line of defense?
We recommended a layered approach to security, where ongoing training plays a big part. It includes short weekly e-newsletters with a quick micro-training video, and follow-up quizzes of only 4-5 questions. This is all tracked, so you can see how everyone is doing and there is a leaderboard to promote a little bit of internal competition to help make it more fun. It is all very easy and can be done as time allows, so it causes little interruption to someone’s day.
Next comes Phishing Email Campaigns where staff are sent the same types of emails sent out by hackers attempting to gain their information. In this instance though, if an employee makes the mistake of falling for the phishing attempt, you are not compromised, they are simply alerted to their mistake, taken to a quick micro-training on the issue, and you are alerted, so you can make sure they are getting what they need to ensure it doesn’t happen again.
Then there’s the Dark Web component. A Dark Web Breach Assessment (DWBA) shows what information is currently out there, so you are aware of current vulnerabilities and can address them. We say current because, it is just a moment in time and due to constant cyberthreats, the next breach is right around the corner, if it hasn’t already happened. Therefore, having ongoing Dark Web Monitoring (DWM) provides proactive monitoring services, so you know if/when any of your data becomes available on the Dark Web, allowing for the potential threat to be quickly addressed and ensure you are better protected from possible data breaches.
GO Concepts is dedicated to working with the Development Disabilities community throughout Ohio to help them best protect their network and private data. Our commitment to County Boards of DD and the agencies and independent providers that work with them, insures your organization will have a professional information technology team that is highly experienced in your specific needs and ready to serve them, whether working with your existing IT staff or as your IT Department.
For help better securing your information technology, contact the team at GO Concepts.
