How to Protect Your Business Against the Dark Web

Most small business owners are familiar with the term the dark web. Understanding the dark web is half of the equation; the other half is knowing how to protect your business. The internet is full of billions of sites and addresses. It’s understandable to be confused about how much is shrouded in secrecy. This article will explore the dark web and inform you on how to protect your business.

To understand the dark web, let’s first go through the different levels of the internet: the surface web, deep web, and dark web

What is the surface web?

The surface web or visible web is what the general public uses to conduct standard web site searches. It’s the part that is indexed by search engines. Interestingly it’s the smallest part of the internet.

What is the deep web?

The deep web holds content that’s invisible to search engines. It consists of information that most wouldn’t want visible in a web search. For example:

• Content of personal email accounts
• Content of online banking accounts
• Legal documents
• Medical records
• Companies data on their private database
• Intranets and internal sites
• Content of social media accounts

You can access most deep web sites through the surface web using the same browser and traditional hostnames. Accessing content on the deep web is relatively safe and legal.

The deep web can be unsafe when we think about traditional ways criminals obtain our personal information. For instance, you don’t have a strong password, access personal data through an unprotected public Wi-Fi, or give knowledge within a phishing email scam.  Now that information has been stolen, criminals try to sell that information, and they may turn to the dark web.

What is the dark web?

The dark web is also not indexed by search engines and requires specific software, authorization, or configurations to access. You cannot reach the dark web through traditional browsers like Chrome or Safari. There are specific browsers used to access the dark web.

The dark web uses multiple layers of encryption security to maintain anonymity, and site owners mask IP addresses allowing users to communicate in secret. Once connected, a user will find it is messy and elusive. Searching is difficult, and websites are continually changing.

The dark web is often associated with illegal activity. It’s difficult to measure the amount of criminal movement because finding accurate numbers is challenging. What can be said is there has been an increase in overall activity. A 2018 study, Into the Web of Profit, conducted by Dr. Michael McGuire at the University of Surrey, shows that the number of dark web listings has increased 20% since 2016. According to the study, if you excluded those selling drugs, 60% could potentially harm enterprises.

How it impacts your business.

The dark web can have an impact on your business. Large companies can spend millions on IT security resources, while small companies are not spending that amount or paying attention to possible threats. Smaller businesses are also less likely to detect a data breach or notice stolen information placed on the dark web.  Cybercriminals know this, so your business is a direct bull’s eye.

If your company does fall victim to any cyber threat, the ramifications could be overwhelming to handle.

• Loss of sales
• Loss of customers
• Loss of public reputation/branding
• Cost of investigation
• Cost of technical recovery
• Legal defense
• Fines
• Change methods of business

How to protect your business?

Too often, businesses end up taking a reactive approach to dark web threats. Assuming the probability is low, and they could manage it.  This approach can be expensive. Fortunately, there are steps to help protect and prevent criminals from taking data or personal information.  Knowing about the dark web is a step in the right direction. Create practical safeguards to make your data hard to interpret. Here are some other preventive actions:

Assume your company is a target

Small to medium companies are considered lucrative for cybercrime and hacking as a service is in demand. Criminals do not look for the business size – they look for ease of access.  Most attacks against companies involve identity or account takeover. The most common forms of information stolen are user credentials or personally identifiable information, according to Javvad Malik’s article, Be afraid of the dark web – or learn to monitor it.

Deploy dark-web monitoring and response tools

An outside IT security professional is usually required to configure using specific tools. There are multiple tools and resources available. The platform should have capabilities to analyze, identify, and proactively monitor your company’s secure information.

Have a disaster recovery-response plan

Essentially the disaster recovery plan allows for the IT department to recover lost data and continue to operate after a failure, threat, or breach. A disaster recovery plan will outline exact instructions on how to deal with an unplanned incident, and how to recover lost information. Evaluate risks to your business and incorporate as many scenarios as possible.

Be aware of employees

Employees can be an unknowing source for a cyber threat. Employees can accidentally leak data if they fall victim to something like a phishing email.  Disgruntled ex-employees could also be behind a data leak. They could move sensitive data to their laptop and share it.  Reduce human error with proper training and education. IT can also help elevate the situation by placing firewalls, email security, and deploying web filters to block malicious websites.

Research training and education

Explore cybersecurity awareness training for your entire staff. By reinforcing security best practices employees are better equipped on how to respond or best approach a threat. Recommend an outside trainer or a managed IT service provider to help educate you and your staff properly.

If you don’t know where to start, consider hiring a professional IT security company.

Terminology:

DDoS – Distributed Denial-of-Service, is a type of attack where the perpetrator uses more than one unique IP address or machine, often from thousands of hosts infected with malware, are used to target a single system causing a denial of service.

Dark Web – Is part of the World Wide Web that exists on overlay networks that uses the internet however requires specialized software, authorizations or specific configurations to access.

Deep Web – Is part of the World Wide Web that is not indexed by search engines. The deep web is also known to be called “invisible web” or “hidden web”. Usually, it requires a password or other security access to get past public-website pages.

Surface Web – is part of the World Wide Web that is indexed by search engines. It’s readily available to the general public.

Tor Browser – a web browser that allows users to view the internet anonymously on the dark web. Uses the URL connection .onion.

URL – Uniform Resources Locator, a reference to a web resource that points to a location on a computer network and a mechanism for retrieving that source.

VPN – Virtual Private Network, is a private network that extends across a public network, that enables users to send and receive data between you and the VPN provider.