Deep and Dark Web Risks
Cyber adversaries sell stolen data and network access, leak pilfered content, and boast about their achievements across the dark web. They use stolen credentials to impersonate authorized staff so they can bypass perimeter defenses and move through your network undetected. Once inside, adversaries exfiltrate sensitive files and post samples of your proprietary data on underground forums to prove the breach and demand payment. By the time these leaks appear, the traditional security perimeter has already failed, leaving your organization’s reputation and assets exposed to the highest bidder.
Dark web and identity intelligence provides defenders with insights into risks that otherwise might go unnoticed, empowering organizations to:
- Neutralize threats stemming from confirmed credential exposure.
- Prompt response workflows to validate and remediate potential compromise.
- Align crisis response and communications workflows with legal and public relations teams.
- Stay informed of unknown or emerging risks that are occurring outside your monitored environment.
Solution: Unit 42 Deep and Dark Web Service
The Unit 42® Deep and Dark Web Service monitors the dark web for potential threats to your organization and its business operations. Organizations partner with Unit 42 to identify critical information or leaked credentials that surface on the dark web, offloading dark web risk exposure to a trusted partner. This capability frees up already overtapped SOC resources to scope their triage focus, improving the effectiveness for analysts to spot nefarious activities.
Our Unit 42 team of experts help your security team by:
- Offloading the operational risk of dark web monitoring, limiting your exposure to risky research that might be unauthorized based on corporate security policies.
- Eliminating the need for security analysts to manually triage dark web alerts, freeing up your security team’s valuable time. Our Unit 42 analysts prioritize findings, surfacing verified threats that require your immediate attention.
- Offering monthly deep-dives on operationalizing findings. Our analysts provide a contextual perspective, helping your team understand whether a discovery is unique to your organization or consistent with wider dark web findings encountered across our client base.
“We act as your deep and dark web analysts, investigating suspicious content, escalating prioritized findings, saving you valuable time.”
— Director of Intel Services, Unit 42
Monitoring and Reporting Options
Our Unit 42 team works with your security team to define core dark web monitoring use cases and then aligns our research with your priorities. We offer you the ability to purchase proactive continuous monitoring or a retroactive point-in-time snapshot. For both offerings, we surface critical findings, such as data breaches or access claims, immediately while we report more routine findings, such as potentially exposed credentials, in bulk. As a monitoring customer, your organization receives monthly reports that detail these noncritical discoveries.
The snapshot report or monthly reports include an inventory of leaked credentials, associated impacted IT services, and the file path for infostealer infections. We also provide enriched domain intelligence that identifies site forgeries and typosquatting attempts, enabling your team to mitigate risks to your organization’s brand and customer trust.
To complement these deliverables, Unit 42 analysts host monthly briefings to translate the findings into clear operational impact and advise on specific defensive actions for your security team. These sessions provide direct access to our experts, ensuring you can clarify any discoveries and align your response to the shifting risks within the dark web.
Analyst-Curated Intelligence for the Dark Web
Table 1. Unit 42 Deep and Dark Web Service Methodology |
||||
|---|---|---|---|---|
Scope |
Analyze |
Assess |
Report and Support |
|
Gather Organizational Content |
Analyze Multiple Datasets |
Assess Findings |
Elevate Critical Findings |
Report Findings |
Collaboratively build a keyword list and understand organizational priorities. |
Triage findings from across several deep and dark web sources for true positives. |
Determine the relevance of compromised credentials, leaked sensitive data, and threat actor chatter. |
Flag imminent dark web threats or claims of access to your data or network as out-of-band reports outside of the regular reporting cycle. |
Provide a clear, detailed report with key findings and actionable recommendations. |
Learn more about Unit 42 Deep and Dark Web Service.
