The Internet can be a scary and daunting place. Everything is permanent, there’s a vast web of information to sift through, and there are thousands of corners of the internet you might not even know exist. There’s one particular area that you should be sure you pay attention to, or are at least aware of. Even if you don’t use the internet or visit websites on a daily basis or you think you’re the most knowledgeable person on the internet, the Dark Web is an area many people are unfamiliar with. It’s a corner of the internet riddled with criminals, scammers and masters of disguise. Unlike just pulling up a browser like Internet Explorer or Google Chrome, or visiting websites like Google and Facebook, people on the the Dark Web use tools to hide their identity and location in order to sell illegal items like drugs or guns.
Even worse, what you may not know could affect you as a small business owner, many times the Dark Web is used to sell and steal people’s identity and gain access to valuable information such as your social security number, credit or debit card information. If criminals on the Dark Web gain access to this information, it could have a devastating effect on your business and result in things like extreme losses in profit and worse, details on your business’s bank accounts as well as your personal information will be readily available to be sold and distributed all over the Dark Web. In order to protect you and your business from the Dark Web, you first need to understand how it works, and how these criminals navigate its dark corners. Then you will be equipped with the tools to keep all the valuable information about you and your business in your hands and out of the hands of these criminal masterminds.
What is the Dark Web?
Ulike the “clearnet”, or the regular internet (Google, Facebook, etc.), the Dark Web allows users to equip certain security tools to make web searches anonymous. This means that no matter what websites they visit, or what they search for (including how to steal data), there’s no way to tie the person back to the searches. There’s no way to catch the criminals. Not only can these cybercriminals hide their identity while planning their latest crime, they can also hide their location. So there’s no face to attach to whatever illegal activity is taking place, and also no way to know exactly where these attackers are. Criminals use the Tor encryption tool to do this as using it hides your identity and internet activity. Tor is basically an internet browser that makes everything you do on the internet anonymous. For example, you can use Tor to change your location so it looks like you’re in a different country than you’re really in.
This is what makes the Dark Web so enticing for anyone looking to get involved in illegal trade and sale of information: no one can catch them. They can use Tor to access these hidden marketplaces or Dark Web websites. The Dark Web is actually not all bad. It is also used by the United Nations and Facebook to protect people in oppressive countries. Because people suffering under repressive regimes can use it because of its anonymity, the Dark Web has become a hotbed of criminal activity where criminals sell and buy information like driver’s licenses, social security numbers, credit and debit cards, subscription services, passports, diplomas, medical records, etc. Typically, your information can be bought individually for a cost, or as a “Fullz” bundle that basically gives criminals a whole package of information like SSN, birth date, account numbers that give the attacker immediate access to a bunch of personal information. There are even tutorials that teach you how to steal data. Check out this article to learn how much various pieces of information are sold for on the Dark Web. So how do you protect yourself from losing thousands of dollars and risk personal information being exposed to the Dark Web?
Why do you need to be aware of it?
Not many people know what the Dark Web is let alone that it exists. Many small business owners have no clue that their business and personal information is at risk of being sold and used by the criminals that inhabit the Dark Web. A report by Switchfast, an IT-service organization that focuses on helping small businesses, found that 26 percent of small business employees don’t know what the Dark Web is or how it can steal data. Some people don’t even know they were hacked until it’s too late. Even if you do know about the Dark Web, navigating it alone is really difficult. It’s messy, website addresses change and viruses can be easily downloaded on your computer.
To learn more about why small businesses should be concerned about the Dark Web, read this article on Entrepreneur, written by the CEO of Switchfast, Jim Anderson.
If a cybercriminal hacks your business and gets into customer records or someone on the inside wants to steal information, you better be sure they’ll use the Dark Web. Being aware of what the Dark Web is and how it works, how criminals use it, is the first step to help you start to increase security and identify any breaches or vulnerabilities.
How to protect your business from the Dark Web?
The main defense you have as a small business owner against the evils of the Dark Web is simply monitoring. There are tools you can use to monitor the Dark Web that tell you to respond appropriately. These tools show you what information to look out for (you can choose) and you can get notified when your personal data is found on the Dark Web. This way, your business will be alerted to data breaches that you might not even know were happening and you can respond faster to prevent further damage. Experian offers a service that monitors the Dark Web to look out for activity that is linked to your identity and scans over 600,000 web pages daily. Getting an outside company to do the monitoring for you is a good idea as monitoring it yourself can be tedious work as you’d have to keep your eye on hundreds of thousands of websites. These companies, like Experian, can give you alerts if customer or employee data is being sold.
However, even cybersecurity professionals have to be quick to beat cybercriminals before data is exploited. According to research by Recorded Future, 75% of all discovered vulnerabilities show up online before they are listed in the National Vulnerability Database, with almost a week in between, which is a huge head start for cybercriminals. By keeping an eye on these vulnerabilities and how exploits are developed for sale on the Dark Web, professional monitoring organizations can try to close the gap. They can also gain insight into recruitment attempts to get people to help sale data on the Dark Web. These recruitment attempts are slowly growing, according to analyst Avivah Litan of Gartner. By having the same information as cybercriminals, the pros are warned about angles of attack and can try to manage the vulnerabilities and erase them to prevent future attacks.
As you can see, monitoring professionals have a lot of work on their plate in order to protect you and your business’s secure data. What you can do is be generally aware of what’s going on in the Dark Web, the latest recruitment attempts, how professionals are keeping an eye on these schemes, etc. You can also look out for mentions of your business, names, emails and other sensitive things like assets. You can also search for people that are talking about your industry, any software you use and related data. By doing this, you’re another step ahead of the criminals trying to rob you.
Increase cyber security measures
There are things you can do to increase your cybersecurity that don’t require outside companies and ultimately leave you in a better position to not get hacked or scammed online. Understanding the scale to which data records can be stolen and how you can be scammed will help prevent all of this from happening. In the first half of 2017, 1.9 billion data records were compromised according to Gemalto’s Breach Level Index report. In the first half of 2018 this number jumped to 4.5 billion Cyberattacks are still increasing, so you need to constantly be aware of the latest scams and constantly be on top of your cybersecurity measures.
Lately, businesses have been having a hard time protecting their data with more phishing scams, more botnets, and ransomware scams.
• Phishing scams - there were 1.2 million phishing attacks in 2016. Basically, they come in the form of a fake email that looks real (from your bank, employer, etc), something you use frequently. The scammer tries to get you to log in to whatever it is because he or she wants your login details in order to be able to steal data/money from you. There’s a link in the email that takes you to a website that looks like the real website, but it really is a fake one and just wants to steal your information. The wording in the email is designed to trick you.
• Botnets - A number of internet-connected devices of which each is running one or more bots. These bots are “internet bots” and can do things automatically and at a much faster rate than a human. The bots usually do fairly simple tasks that are repetitive. They can gain access to your computer through coding, or building a computer program that can accomplish a specific task, in this case, gaining control of your computer. Sometimes you can be directly hacked and sometimes the hack is done through a “spider” that sifts through the internet looking for holes in security. They basically want to add your computer to their network. The bots install software after tricking you, and then the person who created the bot is notified and now your device is under their control.
• Ransomware - basically, someone uses a software to hack your computer and requests ransom. Usually the hacker threatens to make your data public or blocks access to certain data or files until you pay a certain amount of money. You cannot access whatever was attacked until you pay the ransom. According to an FBI report, 4,000 ransomware attacks occurred from the beginning of 2016 until June of 2017. In the beginning of this type of cyberattack, attackers would use misleading apps, fake antivirus tools and ask users to pay fees to fix fake problems. They might flash fake FBI warnings, that the victim would be prosecuted unless money is paid. Now, the main thing is called “crypto ransom” where files are changed and basically hacked and the victims have to pay to get access to their own files. It’s very tough to beat ransomware attacks, so hard that experts often advise that sometimes people just pay the ransom.
Train Employees on these threats
Luckily, there are steps you and your employers can take to protect the valuable data associated with your business. Make sure you are aware how to combat these various scams and hacks in order to train your employees on these threats. If everyone is aware than your business is in a better position to keep information and data secure.
Phishing scams:
• Don’t reply right away and type in the information to your account. Contact the person directly to confirm why that person wants your data. Call them, or talk to them directly to see if they really sent this email or not.
• Don't ever click on the link in the email, type the URL into the address bar of your browser or see if you’ve saved or bookmarked this site before, to confirm if it's a legitimate website. It could just be something that looks like it's from someone you trust but it could take you somewhere that would try to take your data.
• If there are attachments in the email, never open them. There could be malware, or software designed to damage your computer, that can instantly install itself. Even if the sender is familiar, still be cautious. Install security software like Norton that can scan and remove any sketchy attachments If you have an IT department (or a specific person) have them monitor company account access.
• Delete old accounts, make sure everyone’s permissions to login into any sites associated with your business are up to date and flag suspicious logins or requests for data.
• Be sure you and your employees only visit secure websites, especially on any company computers. You can check this by looking at exactly what is typed in the address bar. You should see: “https://” not “http://”. The “S” stands for security.
• Lastly, just update security software. If anyone is asking to disable your firewall or antivirus (software that helps protect your computer from viruses) be skeptical. Never stop running software and keep it updated. If you have an IT team or person, comply with what they say.
Botnets:
Most people who are attacked by botnets don’t even know it’s happening and that their computer is at risk. There are easy things you can do though when using the internet that can remove any botnets already installed on your computer but prevent them from being installed in the first place.
• Be sure that you have a good security system installed that can detect any malware that has been installed in your computer from the internet, removes what’s already been installed and prevents any future attacks.
• Always update your computer to the latest system. For example, Macbooks frequently tell you to update - don’t wait. Hackers can often find holes in computer’s systems that haven’t been updated which then allow botnets to be installed. Set up updates to install automatically so you can be sure your computer is always at its highest defense level against attackers. Be sure you’re doing all of this on any devices your business uses (or you use) lie computers, phones, tablets, etc. if a certain weakness in security is found on one device, cybercriminals will often find ways to exploit the same thing on other devices.
• Again, never click on links or download attachments from unfamiliar email addresses or any emails that appear to be fake. Make sure you always have a firewall when using the Internet. Apple computers always have one pre-installed but if you have a Windows device, you must look into other software (Norton, McAfee).
Ransomware:
• Make sure your employees understand why it’s bad to click on links and open attachments. However, certain schemes such as WannaCry, ransomware can spread without any action on your part. Train people what to look out for - suspicious signs on systems you use at work (on computers) and how to report them.
• Consider playing around with user behavior analytics. This is basically trying to set what normal activity is and monitoring anything out of the ordinary. You’re focusing on users and flagging suspicious behavior so you or IT can investigate. Different things can be flagged like an employee logged in to business accounts at 2 am or trying to change administrative privileges, mass failed login attempts, email attachments sent to personal accounts, etc. User behavior analytics is great because it can pick out anomalies in user behavior and can see if a legitimate user’s credentials are being used by an outside hacker. You can quickly see anything that’s different from usual activity and find stuff that can alert to theft on the inside or sabotage. You still need an experienced security officer to look into these things but by tracking all of this you reduce the time it would take to discover problems, when you can identify discrepancies in user actions. Them you or IT can flag and prevent attacks from the inside.
• Another thing you can do to defend against ransomware attacks is installing a good antivirus or anti-malware software if you don’t already have one.
• Again, don’t open attachments in suspicious emails, don't follow links in emails you’re unsure are legitimate, always close the email and go to the website yourself.
• Also make sure you have strong passwords and don’t reuse them. Back-up your data and do all of these things on all of your devices (phone, computer, etc).
All of this can seem very scary, but being the victim of a data breach or having your data stolen and sold on the Dark Web is easily preventable. Cybercriminals are always looking for holes in security or unsuspecting victims. If you do your part to make sure you follow these rules and make sure you implement basic defenses, you will be able to protect you, your business and your employees from losing a huge sum of money or your devices being taken over by hackers. If you are aware of the latest scams and how to protect yourself, simply by doing some quick research over the internet, you will be ahead of cyber attacks and these criminals will lose and you will win, and everyone’s identity stays secure.
