Businesses leaders often think they don’t need to worry about the dark web due to a lack of understanding. They may not know what the dark web is, or they might think that it can’t impact their business.
But any business, from the enterprise level down, needs to take dark web activity seriously. Hackers often post leaked information and stolen passwords on the dark web. If passwords from your organization are compromised, or if employees are reusing passwords from breached sites for their work accounts, you’re vulnerable to cyberattacks.
One organization’s dark web email scan revealed that 30 emails had been compromised, including the login credentials of the owner’s bank account. And there have even been cases where more than several thousand compromised passwords for email accounts were detected.
To protect your business, incorporate password compromise assessments or dark web monitoring as part of a comprehensive, robust cybersecurity plan.
Why you should be scanning regularly
According to research, most security breaches aren’t discovered until months after the attack. In their Cost of a Data Breach Report 2022, IBM found that it takes an average of 277 days for companies to identify and contain a data breach. Businesses are often only made aware when they discover that sensitive information is already for sale on the dark web.
Your organization needs to be proactive in identifying whether sensitive information has been compromised. By the time the information goes up for sale to hackers, it’s too late.
Routine dark web scanning can help you identify risks and possible exposures faster. Scans can detect any compromised employee credentials and allow you to set up dark web monitoring so that you’ll be alerted for any future leaks.
They also give you a regular look into the overall health of your cybersecurity controls. Using them in conjunction with regular vulnerability tests can help you continue to identify and remediate potential weaknesses in your cyber defense.
How you can improve cybersecurity
When you’ve identified a breach, take measures to remediate the situation and change any compromised credentials. You should be using multifactor authentication so you're more resistant to credential attacks.
You also need to look at how you can continue improving your security posture. Even if a scan indicates that your business data hasn’t been compromised, you can’t be lax in security.
Use scans and other forms of testing as opportunities to find out any potential vulnerabilities. And continue to provide your users with training on their security responsibilities.
Here are some ways you can improve your organization’s cybersecurity:
Provide proper employee training
Employees are your first line of defense against attacks, but they also represent significant potential risks. To keep your business safe, prioritize providing effective security training to all employees.
Research studies have found that more than 60% of people who find a thumb drive will plug it into their work laptop, despite not knowing its source or contents. Enterprising cybercriminals have taken advantage of that tendency in the past, leaving thumb drives with malicious software in employee parking lots and thereby gaining network access.
With proper training, your employees will be able to identify and avoid security threats like phishing emails, suspicious websites and more.
Use password best practices
It’s also important to educate all employees on safe password practices.
Passwords that have been made public, especially those associated with an email address, will be used repeatedly when attempting future attacks. Cybercriminals can also use leaked information to try to access important personal accounts, like those for banking and social media.
To limit the potential impact of a security breach, employees shouldn’t be using the same password for multiple accounts. They also shouldn’t use their business email addresses to register for any nonbusiness-related activities. And if their credentials are ever exposed, those same credentials can never be used again.
For further protection, a dark web scan tool can quickly identify whether any employees have had their business credentials compromised after using them for nonbusiness reasons, and help you avoid the associated risks.
How Wipfli Digital can help
At Wipfli, we provide you with the solutions you need to be more confident in your cybersecurity. Our consultants work with you to help employ effective employee training, endpoint protection and vulnerability assessments. We also have a fully staffed SOC to guide you through your next audit.
Contact us to learn more about how we can help keep your business secure.
