Deep and Dark Web Monitoring

ACID Technologies provides 24/7/365 dark web monitoring services to companies and organizations operating in a wide variety of sectors and industries, including banking and finance, healthcare, education, transportation, state and local government, retail, and others.

The monitoring conducted by ACID is meticulously and specifically tailored for each client in terms of keywords and languages, in order to yield optimal results.

Once a threat is detected, the intended victim is alerted in real time and provided with all available details, to enable it to effectively respond. Additional information is provided as it becomes available, enabling to fine-tune the response.

By implementing targeted countermeasures, the organization can reduce the harmful consequences of the attack – be they disruption to operation, loss of business, payment of heavy regulatory fines, reputational damage, or other. Where the detected threat is an attack still in its planning stage, it can potentially be thwarted altogether.

The dark web is a part of the internet that includes sites that are not indexed by commonly used search engines, such as Google. They are accessible only through anonymized software like the browser Tor or I2P, which uses a distributed network database. Users are thus able to maintain their confidentiality: both their identity (IP address), and the websites they choose to visit.

These characteristics make the dark web attractive to cybercriminals, who use it for illicit activity such as selling drugs, weapons and malware.

On the dark web, cybercriminals also share information, develop and coordinate cyber attacks, negotiate Ransom as a Service (Raas) transactions, and sell confidential information that they have obtained by breaching targeted organizations’ systems (for example, credit card information, personally identifiable information (PII), login credentials, financial information, medical records and more). The perpetrators are often motivated by the prospect of financial gain – either by selling the stolen information or using it to extort its original owners.

Groups motivated by ideology, whether political, social, environmental or other, are also known to have used the dark web to plan and coordinate demonstrations or attacks on organizations they perceive as adversaries.

It should be noted, however, that the dark web is also used for non-criminal activity, for example, by journalists who must protect their identity in countries that do not respect privacy and allow free speech.

Dark web monitoring is essentially a continuous search of the dark web with the aim of detecting threats. Given the enormous amount of information found on the dark web, in order to yield effective results, the monitoring must be as precise as possible, using keywords and terms that are specific to the information sought. When the languages relevant to the organization that has engaged a dark web monitoring service provider are also taken into consideration in the search parameters, as ACID does, the results are even more accurate, and therefore, more actionable.

The importance of dark web monitoring lies in its ability to detect threats – those that are emerging, and those that have already materialized and caused damage to the targeted organization. Knowledge is key here: An organization that receives real-time alerts to threats, such as information about a cyber attack being planned against it along with all available details, can act upon this information and take the necessary mitigation steps. Also, an organization that learns that its data has been compromised and is posted on the dark web can investigate how, when and by whom it had been stolen. Often, this will point to a security gap in its systems that it is unaware of, one that possibly occurred weeks or months earlier and may still require closing to prevent further data leakage. Knowing which data has been compromised also allows taking action to lessen the harmful consequences of the breach. Providing these real-time actionable alerts and information is precisely what ACID does.

When choosing a dark web monitoring service, one would be well advised to consider the following features:

• Extent of coverage – the broader the range of dark web sources that are scanned, the better, as this increases the chances of detection. It’s important to verify that the monitored sources include marketplaces at which stolen information is offered for sale.
• The information that is sought – it is imperative to include types of information that the user considers sensitive, for example, personally identifiable information (PII), and where transactions take place – credit card information. Other types of information are also highly sensitive, for example, medical records, including anamnesis, test results and details of treatments, which are stored by healthcare facilities to enable providing proper and timely medical care to patients. Where research and development activities take place, as well as in the manufacturing sector – intellectual property and trade secrets are critical not only to competitiveness and success; if compromised, this might even place an organization’s continued operation at risk.
• Quick alerts – receiving alerts as soon as possible after information pointing to an attack is detected on the dark web increases the targeted organization’s chances of stopping the spread of the sensitive information and the escalation of the attack, and reduce the extent of damage caused.
• Precise alerts – alerts that provide the targeted organization with as many details as possible about the attack and its consequences allow implementing effective countermeasures.