Insights
INSIGHTS
All Topics
Why charities need to manage the risks of the Dark Web
16 Jul 2020by Chloe Green
In the depths of the internet lies the Dark Web. Most charities probably don’t even think about it, but here’s why they should
This article is sponsored by Skurio, innovative cybersecurity experts.
The ’Dark Web’ conjours up images of sinister figures in hoodies bent over keyboards in dark rooms. It’s often painted in the press in dramatic tones as a haven for the worst kind of crime.
Yes, the Dark Web contains a lot of nefarious goings on, including all of the extreme examples often seen in the media. But the majority of criminal activity happening on these unseen platforms is based around the run-of-the-mill trade of stolen data, hacking services and fraud – and this is a truly vast industry, with an estimated 15 billion stolen account credentials such as passwords circulating on hidden criminal forums.
It is in the valuable trade of data where the most lucrative business lies, and for legitimate organisations that process and store sensitive information on service users and donors, where the real dangers lurk.
What is the Dark Web?
The ’Dark Web’ is the part of the internet that isn’t visible to search engines and requires the use of an anonymising browser such as Tor, which masks a users’ identity, to access it. It’s used for any kind of activity that needs to be kept hidden, such as for whistleblowing and for people to communicate behind the backs of oppressive government regimes. But behind every legitimate economy there’s usually a black market, and the digital world is no exception.
Many of the Dark Web’s sites operate in a similar way to Amazon or other entities on the surface web, with businesses working hard to trade their services to loyal customers, sometimes in a very ’professional’ guise, except what they trade in is illegal and completely unregulated.
What do charities need to be aware of?
The risk to charities from the Dark Web is not discussed all that widely because the majority of charities are too concerned with their missions and keeping the lights on, and with what they perceive as more immediate risk management. The Dark Web is difficult to understand and even more difficult to access and monitor, and most organisations aren’t even aware that they are a target – until, of course, it’s too late.
However, the reality is that it’s often the small to medium sized organisations that are painted with invisible bullseyes to cyber criminals operating on the Dark Web. Threat actors know that large organisations like global institutions and banks are better protected and so much harder to penetrate. Many hackers are ultimately lazy opportunists.
Charities that are serious about safeguarding their reputations need an understanding of the Dark Web’s risks and why it’s such an important part of any cyber security threat monitoring strategy.
Related Articles
On the Dark Web you will find:
- Vast ’dumps’ of leaked data such as credit card data being distributed and sold
- Stolen password credentials for hacking into accounts
- A recent rise in stolen healthcare data containing very sensitive information on patients, with multiple serious implications for healthcare organisations
- Stolen or counterfeit goods such as medicines and even unauthorised COVID-19 testing kits that are not only financially damaging to healthcare organisations but are extremely dangerous
- Forged documents such as identity cards and membership cards, for things like the Red Cross first aid courses, that end up damaging the credibility of real organisations and costing them financially
- Traded ’reconaissance’ reports with information detailing exactly how a specific organisation can be hacked, its servers and its security weaknesses
Ultimately, if your organisation is being discussed on the Dark Web as a possible target, or if data on your donors or beneficiaries is being traded, or your goods being counterfeited, you will need to know about it fast. It could already be happening and the damage being done.
What can charities do?
John Evans, Intelligence Analyst at cyber threat monitoring firm Skurio says: "Let’s be realistic. You may have excellent network security, strict control of your staff, and have done all the right stuff, but can you say the same thing for your beneficiaries, service users and donors? Do they all behave responsibly with password management? Probably not as a whole."
"It’s understandable that suggestions aren’t enforced around passwords. If someone wants to go to your website make donation and can’t log in because of a hard-to-remember password, it will frustrate them and stop them donating. But if a customer uses an old password they’ve used elsewhere, it won’t take a genius to figure out what that password might be. Most users will have already been included in one or more breaches in their lifetime. So it’s in a charity’s best interests to encourage their users and donors to set as secure a password as possible, and require a second means of authorisation."
Monitoring is also a must. Using an automated system to search for your organisation’s domains and IP addresses on the Dark Web can easily detect a breach concerning your assets, and find exactly where data is being sold and discussed.
"Monitoring the Dark Web is difficult but not impossible," says Evans. "You just need a safe environment to access it and an automated solution or experienced third party. You should never try to access the Dark Web yourself as the risks from encountering dangerous material or malware are too great, and you gain much better insight from having experts on hand. Skurio, for example, liase with the National Crime Agency and law enforcement."
"The days of cyber criminals being unstoppable are over, and with a bit of detective work, Dark Web criminals can be traced and caught. The more we as leaders and cyber security professionals do to combat the Dark Web, the better protected well be both at work and in our personal lives."
Find out more
Learn how your charity can access Skurio at a discounted rate
Chloe Green
Chloe Green
More on this topic
Related Content
Recommended Products
Featured Products
30 Dec 2024by Ioan Marc Jones
Everything you need to know about the Charity Commission
28 Dec 2024by Elaine Taylor
What's the difference between charity and philanthropy?
27 Dec 2024by Ioan Marc Jones
The best online event platforms for charities
Our Events
Charity Digital Academy
Our courses aim, in just three hours, to enhance soft skills and hard skills, boost your knowledge of finance and artificial intelligence, and supercharge your digital capabilities. Check out some of the incredible options by clicking here.
© 2022 Charity Digital Trust. All rights reserved
