Security Practitioners Lack Dark Web Threat Intelligence Training

Monitoring and assessing threats from the cybercriminal underground on the dark web requires the right tools, processes and expertise — many of which security teams don’t have, according to a recent report from Kela.

Increasing threats emerging from the dark web can put organizations in danger if they don’t have ways to assess and mitigate threats proactively. Yet despite the fact that dark web activity has increased 340% over the past three years, many organizations dismiss the idea that dark web threats should concern them. Security teams that are aware of the threat struggle with having the right tools at their disposal, and while the intention may be good, execution is nearly impossible.

In Kela’s State of Dark Web Cybercrime Threat Intelligence 2022 report, 400 security practitioners shared insights into their current approach to dark web threat intelligence. While many are finding success against threats from the dark web, many find obstacles in their way. Here are five of the biggest challenges security practitioners face with effectively monitoring the dark web and solutions organizations can adopt today to strengthen their approach.

Five Challenges to Dark Web Security

With the evolving nature of cybercrime underground, it’s imperative for organizations to have robust processes for dark web monitoring and detection. Yet many teams lack the right resources, access, or even training to do so. Here are some of the challenges security teams are met with today, according to our report.

1. No system or browser isolation: To successfully monitor the dark web, security teams need secure network access, a secure browser and dedicated workstations. However, their biggest challenge is not having that system or browser isolation, thereby putting their network at risk of compromise.

2. Lack of training or experience: A lack of expertise on how to conduct dark web investigations is also a top challenge. Security teams can be supplied with all the hardware and tools they need, but unless there are trained analysts who know what they’re looking for, it’s all for naught.

3. Lack of support from the organization: Tools and training take money and resources, which many say their organizations are not giving to them. A lack of understanding of the importance of dark web monitoring from leadership can result in a lack of support as well.

4. Difficulty finding relevant information on the dark web: With the ever-changing nature of the dark web and no road map to go by, finding relevant information is a challenge. For security teams with untrained or unseasoned analysts, finding actionable intelligence will be impossible.

5. Difficulty in accessing various dark web sources: Finally, security practitioners are simply challenged by access to the dark web in general: getting there safely and securely from their machines and, once there, accessing the sites they need to monitor, like private forums and messaging groups.

Protecting Your Organization From the Dark Web

The aforementioned challenges don’t have to hinder your dark web strategy. These five actions can help you better understand the dark web’s threats and better position you to protect your organization.

1. Monitor for organizational data

In 2021 alone, 40 billion records were exposed by cybercriminals — a 78% increase over the previous year. Proactive protection against dark web threats begins by accessing and monitoring the dark web for organizational assets that may have been released or sold. If organizations experience a breach, monitoring helps them know where their data has gone.

2. Stay current on cybercrime trends

Malicious actors evolve their tactics over time, access networks through different ways, and may even employ multiple actors across an attack. Just as an army would monitor its enemy’s whereabouts, so must a security team understand the current trends malicious actors are using. Security teams can keep up on these trends through industry reports, security blogs, trusted professionals, and more.

3. Define the best mitigation actions

As found in the report, only 52% have a documented dark web threat intelligence policy in place. Security teams will benefit from defining their best mitigation actions, including a way to identify vulnerabilities, assess risk, monitor threats, and take action on credible information.

4. Measure your mitigation efforts

As security teams implement effective approaches to mitigate threats, they should also have the ability to track and measure their efforts as well, allowing them to identify successes and areas of improvement. Measured improvements also demonstrate the value of dark web monitoring to leadership, increasing organizational support and buy-in.

5. Learn tactics, patterns and more

In addition to following trends, security teams wanting to be more effective should also study malicious actors’ tactics, preferences, patterns, and other actions. Knowing the enemy enough to anticipate their next move means being there to defend before they do.

Overcoming Challenges to Dark Web Monitoring

Being able to mitigate threats from the dark web requires not only the right tools for access and visibility but the right training to conduct those investigations knowledgeably. Many security teams lack one or both today—but organizations who invest in tools and training will find themselves well-prepared to stave off dangers from the dark web.