Who are the current users of the Dark Web?
The Dark Web is a busy place, used daily by people from all walks of life. Some use it for legitimate purposes, such as journalists in countries with strict censorship laws, government and military agencies, or cybersecurity researchers. Only about 6.7% of users globally use the Dark Web for illicit activities such as sharing malware, distributing child abuse material, or selling illegal substances or weapons. Of course, many regular Dark Web users sell dangerous, stolen, or illicit items and are also involved in cybercrime. Learning more about who uses the Dark Web can help security professionals better defend organizations against threats.
What is the Dark Web like today?
The internet, as we know it, has three distinct layers, and the Dark Web is by far the smallest:
- The Surface Web: This is what most of us access in our regular, day-to-day activities. It’s available to the general public using standard search engines. Shopping sites, social media platforms, streaming services, news organizations, and other websites that people commonly visit are found on the Surface Web. It can be accessed using standard web browsers without any special configuration, such as Mozilla Firefox, Microsoft Edge, and Google Chrome. The Surface Web seems vast, but it actually represents only about 4% of the total web.
- The Deep Web: This is the most significant portion of the internet. It is not indexed and cannot be searched by ordinary search engines. Accessing these websites or services requires a specific URL or IP address. Some sites are part of the Deep Web because they block search engines from identifying them or do not use common top-level domains (TLDs). Areas of the Deep Web are often used to store data and content in databases that support services such as social networking sites, insurance companies, or banks. The Deep Web is 400 to 500 times the size of the surface web.
- The Dark Web: This is a less accessible subset of the deep web that relies on peer-to-peer connections. Specialized software or tools are required to access the Dark Web. The Tor browser is the most common method, but other communication platforms like Signal can also be used. The Dark Web represents approximately 0.01% of the total deep web space .
What are the most popular ways for Dark Web users to connect?
More than two million users access the Tor platform daily. While many use it for legitimate purposes, such as circumventing censorship, many others use Tor for nefarious purposes. A quarter of the world’s population has used the Tor browser to connect to the Dark Web at some point. Tor users connect to the Dark Web in two ways:
- Bridge: A bridge is a private server on the Tor network that can provide access to blocked clients, often in combination with pluggable transports, and is registered with the Bridge Authority. This connection method is generally chosen in countries that regulate or suppress internet access. The three countries from which users most frequently connect to Tor in this way are Iran, Russia, and the United States.
- Relay: A relay is a publicly listed server on the Tor network that forwards traffic on behalf of clients and is registered with the directory authorities. This is the most common way for someone to connect to Tor.
How can I protect my organization from Dark Web threats?
It’s worthwhile for businesses to take smart precautions against Dark Web threats. Fortunately, mitigating this risk is easy and affordable thanks to Dark Web monitoring. It’s an essential part of any organization’s defensive strategy because it allows IT teams to quickly become aware of compromised user credentials (before Dark Web cybercriminals do). With Dark Web threat intelligence, IT professionals gain a head start against exposure threats, helping them act to protect the organization immediately and reducing the likelihood of a cyberattack. A Dark Web monitoring solution can monitor credentials in various configurations, typically customized to suit your organization’s needs.
Common types of credentials that can be monitored include:
- Employee Credentials
- Privileged user credentials
- Personal credentials
- Domains
- IP Addresses
- Personal and confidential email addresses of executives
- Email addresses of privileged users
Source: ID Agent
