We often hear from the public sector that web-based attacks that occur at companies like Adobe, Forbes, Sony, or Anthem are not their problem. Public Sector organizations secure their own networks with the best hardware, detection software, and penetration testing, and have in place stringent rules about passwords and top-notch use policies that ensure they are safe. In every case, the security chain is only as strong as its weakest link.
As data breaches and leaks such as these occur to service providers and others that have direct or tangential access to your networks, your own threat level increases dramatically and in many cases without your knowledge. Take, for instance, the Target breach that cost the company millions. That happened as a result of a HVAC vendor with limited access to the network being compromised and allowing the threat actors access to otherwise extremely secure payment networks through their gateway.
This is just the beginning. As Hackers become more sophisticated, organizations will continue to experience web-based attacks through “weak links” and “soft targets.” Additionally, people who wouldn’t normally do anything to harm their organization can potentially be compelled to act in a manner that you would not expect due to unforeseen circumstances. Blackmail artists and web vigilantes are constantly looking for ways to increase their pool of victims. This seems like fertile territory for this type of activity.
The latest announcement of a data breach of an online dating website that allows users to detail their preferences in a potential mate shows a perfect example of this type of threat. Certain threat actors are explicit that they are focusing on government employees since they are the easiest to identify and publically embarrass. This is very much everyone’s problem. The fact that an organization’s employees are at risk should compel their IT and Security professionals to push for more information as quickly as possible.
In the event that there is a data breach, time is not on the side of the victim. The faster the information becomes available, the sooner an organization can start to scan its networks for any unusual activity and begin remediation procedures. The best defense against an enemy that cannot be anticipated is early warning and a specific plan of response that has been distributed before the event occurs.
Being alerted to the fact that an organization’s data is being shared out on the Dark Web is one of the fastest and easiest ways to finding out about a breach of your network and those within your supply chain. Although one organization can not necessarily defend the network of another, it certainly can make informed business decisions on how to protect its own sensitive data from web-based attacks by knowing if something occurs and taking immediate action. Dark Web ID (www.DarkWebID.com) is one company that offers a monitoring platform that helps notify an organization to compromised credentials.
