The Dark Web is a secret part of the World Wide Web that is frequently accessed by terrorists, pedophiles, and criminals of all kinds. Hacker websites on the Dark Web share lists of email addresses and account credentials to enable cyber thieves to break into the accounts of people on personal and business systems to steal their money and the assets of the businesses that they work for.
As a network administrator, how should you be taking steps to protect your company from the threats that hide in the Dark Web? Is there anything that you could feasibly do? What is the Dark Web, anyway?
We get into depth on each solution below, but if you only have time for summaries, here is our list of the 10 best dark web monitoring tools for network admins:
- Echosec Beacon Checks the Dark Web for compromised account credentials, and stolen personal information and financial data.
- SpyCloud ATO Prevention Account takeover prevention with a threat intelligence database derived from Dark Web scans.
- Digital Shadows SearchLight A corporate brand protection service.
- WhatsUp Gold A network traffic monitor that can identify traffic from the Tor network.
- DigitalStakeout Scout A data loss prevention system and threat protection system that includes a Dark Web scanner.
- Alert Logic Dark Web Scanner An account takeover prevention system based around d a Dark Web scanner.
- DarkOwl Vision A threat intelligence service that includes a Dark web scanner as an information source.
- ACID Cyber Intelligence A threat intelligence service that scans all known sources of illegal data.
- Dashlane Business A comprehensive password protection system that includes a Dark Web scanner.
- Have I Been Pwned? A free email address-related Dark Web scan.
- 1 The Deep Web and the Dark Web
- 2 Criminal activity on the Web
- 3 Dark Web Scanners
- 4 The best dark web monitoring tools for network admins
- 5 Defeat the Dark Web
The Deep Web and the Dark Web
Before tackling the topic of blocking the Dark Web from damaging your company’s operations, we first need to explore exactly what the Dark Web is and how it relates to the Deep Web.
The Clear Web
In Deep Web/Dark Web terminology, the World Wide Web that the general public uses is called the Clear Web. This is a collection of websites that can all be accessed through a search engine.
You don’t have to go through a search engine to get to a website because you can just enter its address in the address bar of your browser or click on a link on another page. However, the test of whether or not a website has been discovered by at least one search engine and indexed by it is the defining characteristic of the bona fide web that we all know about. Another term applied to this publicly-known World Wide Web is Clearnet.
The Deep Web
The Deep Web is just as accessible as a Clear Web site by typing in the address or following a link. However, the sites on the Deep Web aren’t indexed by search engines. Search engines use a type of software, called a “web bot.” In Google’s instance, those programs are called “Googlebots.”
The Dark Web
Pages on the Dark Web aren’t accessible by search engines, so they are also part of the Deep Web. The defining characteristic that makes a website part of the Dark Web is the way that it is accessed.
The sites on the Dark Web make themselves difficult to find and to access. It is only possible to see these sites through a Tor browser. Tor is a web security system. The name was originally TOR, standing for “the onion router.” Traffic gets randomly routed through the computers of volunteers all over the world. Before being sent, each web page request is encrypted several times over, with each layer decoded by a key, which is only held by one of the computers on the route.
Tor was invented by the US Navy to secure its own communications and is used by government security agencies and police forces around the world. Tor has its own browser, which is an offshoot of Mozilla Firefox and has all of the necessary encryption processing for Tor built into it.
Criminal activity on the Web
Hackers and thieves do not limit their online presence to the Dark Web. There are scam websites on the Clear Web. Many reputable organizations have a presence on the Dark Web. So, the Dark Web itself is no more of a threat to the world’s businesses than the regular World Wide Web.
When journalists and cybersecurity consultants refer to the threat of the Dark Web, they are using the term as a shorthand for criminal activity on the Web in general.
Dark Web Scanners
Cybersecurity providers have a more precise definition of the Dark Web. Some sites and forums on the Dark Web are used by hackers to buy, sell, and share data stolen from businesses – specifically, login credentials, identity data, such as social security numbers, and financial information, such as credit card numbers. Not all of these sites are configured on the Dark Web. Some are Clear Web sites and some are Deep Web sites.
So, when we look for solutions to Dark Web threats, we are looking for services that know where those credential sharing sites are and how to search through the data that they contain. Those tools are called “Dark Web scanners.”
Some Dark Web protection services are dubbed “monitors.” However, these are the same as scanners because they simply search through the lists of stolen user credentials, and personal and financial data that are available on the web, be it Dark, Deep, or Clear.
The best dark web monitoring tools for network admins
You can read more about each of these solutions in the following sections.
Echosec Beacon is a Dark Web scanner. It is able to hunt down compromised credentials, disclosed personal information and stolen financial data that is available in various locations on the internet.
This is an online service that operates like a search engine. The user enters a name, a social security number, or an email address and then searches through sources in Dark Web marketplace, social media sites, and forms to find incidences of those details up for sale, or openly appearing on free lists.
The tool will also look for websites that mention the named person – information about people is collected for “doxing,” which gathers information to enable a charlatan to either target or impersonate that person in a phishing attack.
The service can identify data breaches and search out malicious information stores that hold data on businesses as well as individuals.
SpyCloud offers two services for account takeover (ATO) prevention – one to cover the employees of companies and the other to protect the customers of online services.
ATO protection concentrates on protecting the accounts that businesses set up for access to their resources, such as network logins or user accounts at websites. A major part of the service involves detecting accounts that have already been compromised.
The ATO prevention service includes a cloud-based threat intelligence database, which warns clients of compromised accounts. The information on disclosed credentials is discovered by a Dark Web scanner. Other elements in the threat intelligence system include known sources of phishing and impersonation attacks, which gives the protecting agent software guidance on which incoming emails to block.
The service also proactively monitors Active Directory and sets up stronger password policies, such as password rotation and enforced password complexity.
Digital Shadows is particularly concerned with protecting the brand and reputation of the companies that use its services. Rather than focusing on account protection, this service protects both the image and trade secrets of the companies that it serves.
For example, the SearchLight looks for company procedural documents, site plans, and internal memos that have found their way onto other sites that are known for trading in corporate data illegally. One incident that the Digital Shadows site recounts is its discovery of ATM designs that it alerted one of its clients about. That client was the bank that used the compromised ATM design.
Although the service doesn’t look for all user account details, it does scour illegal sites for the disclosure of privileged credentials, such as the usernames and passwords of network administrator or DBA accounts. Digital Shadows offers a 7-day free trial of SearchLight.
WhatsUp Gold is a network monitoring system. The software for this system installs on Windows Server. The core module of this platform is a network device monitor and it can be enhanced by a number of add-on modules. One of those add-ons is the Network Traffic Analyzer.
The Network Traffic Analyzer is able to trace the source of incoming traffic and watch where outgoing traffic goes to. The service maintains a database of Tor network entry and exit points and keeps this list constantly updated. When the Network Traffic Analyzer spots one of these addresses as a source or destination of traffic on the network, it alerts the network administrator.
Not all traffic on Tor is malicious. However, there needs to be a reason why someone within your company should be accessing the network at work. The information that Tor traffic is on your network will allow you to identify points for further investigation.
Scout, from DigitalStakeout, is a Dark Web threat intelligence service. The system includes workflows and machine learning to detect anomalous behavior on the network. It then references the external source or destination of that traffic with its Dark Web Scanner and threat intelligence database to identify the malicious actor participating in the suspicious activity.
As such, Scout is a data loss prevention system and an insider threat protector as well as a threat-protection system. Scout doesn’t include any remediation procedures. When a Dark Web threat is spotted, Scout raises an alert in the monitoring dashboard. It is up to the network administrator to shut down the traffic either manually or by deploying threat mitigation software.
The service also protects the brands and reputation of customers by scanning all websites for harmful content about those companies. The relevant source and text of the discovered content is then posted in the Scout dashboard.
The Dark Web Scanner from Alert Logic is an account takeover prevention system. The service scans the Web for account credential disclosure and compiles a list of compromised accounts that pertain to the client. One worrying aspect of this service is that the report of at-risk accounts is sent once a month, which means that the information about vulnerable accounts might arrive too late.
The service doesn’t look for disclosures of personal or financial information of individuals that might be held on the servers of the client company. However, the Dark Web Scanner is just part of a package of system protection measures offered by Alert Logic. The service is included in the Alert Logic Enterprise edition, which is available on a 30-day free trial.
The Vision system searches for mentions of the client company’s domain and email addresses in hacker data exchanges. The search is an automated process. This information is constantly updated by repeated scans and those disclosures are made available in the dashboard for those subscribing companies to which the data pertains.
The DarkOwl vision system is integrated into a package of intelligence services, called Darkint Suite. Another element in this suite is Darkint Score, which is a vulnerability assessment of the client company’s exposure to Dark Web data loss.
Darkint Suite’s data feeds can be integrated into applications through an API. The DarkOwl service is a threat intelligence database; it does not monitor infrastructure or network traffic. Companies subscribing to DarkOwl will also need threat protection and data loss protection software to fully protect their systems.
The ACID Cyber Intelligence service gathers threat intelligence from social networks, criminal sites, chat systems, the Deep Web, and the Dark Web. The information found from these sources allows the service to warn its customers of any threats that may be about to occur and also of any data leaks have occurred.
The data searches are performed by web bots and so they continue to operate around the clock. The data type that the threat intelligence system looks for include account credentials, e-mail addresses and email contents, domain names, payment card data, intellectual property, insider information, personal information about employees, and mentions of the company and its employees in the context of threats.
Customers of the service get access to an account-protected dashboard where alerts are displayed when cyber threat intelligence related to that has been identified. This information is sent to the console as soon as it is encountered and it also sent to a key contact at the client company via email.
The Dashlane Business package is a complete account protection service. It includes password protection, secure file storage, and Dark Web scanning. The scanner looks for login credentials, credit card numbers, Social Security numbers, phone numbers, and postal and IP addresses – all both for the company and for its employees.
This is a cloud-based service and it includes access to the Dashlane customer dashboard through a browser or a mobile app. When a customer signs up for the service, the Dashlane bots perform an initial Dark Web sweep to discover all existing data about that business. From then on, the company’s identity will be part of the search bot’s target terms and if any new instances of corporate data arise, the Dashlane system notifies that customer immediately. Alerts appear in the dashboard and are also sent out by email.
Have I Been Pwned? is a Clear Web site that performs free searches of the Deep Web and the Dark Web for personal or business information. It isn’t necessary to sign up for an account, you just need to enter an email address in the single input field on the service’s Home page.
The results of the search show all data leak events that involved that email address, resulting in the address being displayed in Dark Web attack lists. The service only reports on email address-related data leaks.
Companies can get a scan for all email addresses on their domains. It is also possible to set the service to permanently monitor for new incidences and notify you by email should they arise. You have to verify that you are the owner of the email domain in order to use this service.
Defeat the Dark Web
There are many defense strategies to protect yourself from hackers and the ability to find out what hackers have on you is a distinct advantage. Some of the tools in this list include threat remediation processes, while others just warn you which accounts have been compromised and leave you to fix the problem. You will probably have your own preferred working practices that will lead you to one of these groups.