Navigating the Sea of Data Privacy Laws and Cyber Regulations in 2024

Introduction

Fasten your digital seatbelts, because 2024 is shaping up to be a global whirlwind of data privacy and cybersecurity regulations. From five new comprehensive state data privacy laws in the US, including the Utah Consumer Privacy Act (UCPA) taking effect at the end of 2023, to radical new consumer health data privacy laws, businesses worldwide face unprecedented compliance challenges. But fear not, intrepid captains of your digital vessels! A robust security and privacy program can be your life raft in this regulatory storm, no matter where you navigate the digital seas.

The Perfect Storm: New Privacy, Breach Notification, and Cybersecurity Laws (Worldwide)

This year, businesses are facing a global regulatory tsunami:

1. New Privacy Laws: The US isn't alone. Comprehensive data privacy laws are popping up worldwide, with jurisdictions like Brazil, China, California, Australia, and now Utah, Texas, Oregon, Florida, and Montana leading the charge. Each law brings its own unique requirements, making compliance a complex international puzzle.

2. Breach Notification Blitz: Data breaches are a global concern, and governments are responding with stricter notification laws. From the EU's GDPR to India's Personal Data Protection Bill, expect to see tighter deadlines, broader notification requirements, and potential penalties for failing to report breaches promptly.

3. Cybersecurity Mandates on the March: Governments are raising the bar on cybersecurity, imposing new mandates and standards on businesses across industries. From zero trust requirements to software assurance guidelines, staying compliant will require proactive investment in your security posture.

Key US Data Privacy Laws and Health Data Privacy Regulations to Be Aware of in 2024:

Data Privacy Laws:

• Utah Consumer Privacy Act (UCPA) - Effective December 31, 2023: Applies to businesses exceeding $25 million in revenue and processing data of 100,000 or more Utah residents. Grants Utah residents rights to access, delete, and opt-out of the sale of their personal data.

• Texas Data Privacy and Security Act (TDPSA) - Effective July 1, 2024: Applies to businesses exceeding $25 million in revenue and handling data of Texas residents. Grants similar rights to UCPA, with additional restrictions on data deletion and requiring data security measures.

• Oregon Consumer Privacy Act (OCPA) - Effective July 1, 2024: Applies to businesses exceeding $25 million in revenue and handling data of 100,000 or more Oregon residents. Grants similar rights to UCPA, with emphasis on data minimization and specific requirements for obtaining consumers' consent.

• Florida Digital Bill of Rights - Effective July 1, 2024: Establishes principles for data privacy but does not create individual rights or enforcement mechanisms. Requires businesses to disclose data collection practices and implement data security measures.

• Montana Consumer Data Privacy Act (MCDPA) - Effective October 1, 2024: Applies to businesses exceeding $25 million in revenue and handling data of 25,000 or more Montana residents. Grants rights to access, correct, and delete personal data, with exemptions for specific sectors.

Health Data Privacy Regulations:

• Washington My Health My Data Act: Enacted in May 2023, prohibits the selling of Washingtonians' health data and restricts collection and sharing without consent. Imposes geofencing limitations around sensitive healthcare facilities.

• Nevada Consumer Health Privacy Law (SB 370): Effective March 31, 2024, prohibits selling consumer health data without written consent and restricts collection and sharing. Similar geofencing limitations as Washington.

• Amended California Consumer Privacy Act (CCPA) Regulations: Taking effect July 1, 2023, expand CCPA's scope to include specific consumer rights regarding their health data.

• Colorado Universal Opt-Out Mechanisms: Effective July 1, 2023, requires businesses exceeding $100 million in gross revenue to offer a universal opt-out mechanism for the sale of personal data, including health data.

• Connecticut Senate Bill 3: Took effect July 1, 2023, adds "consumer health data" to its data privacy act, requiring opt-in consent for selling and imposing geofencing restrictions around sensitive healthcare facilities.

Navigating the Calm After the Storm with CyberSecOp

2024 has indeed become a tsunami of data privacy and cybersecurity regulations, leaving businesses feeling like they're caught in a riptide. But fear not, weary sailors! Just as a lighthouse guides ships through treacherous waters, a robust security and privacy program can be your beacon of stability in this ever-changing regulatory landscape.

Implementing a comprehensive program isn't just about weathering the storm – it's about thriving in the calmer seas ahead. By prioritizing compliance, you can:

• Avoid costly fines and legal action: Proactive measures significantly reduce the risk of non-compliance penalties.

• Build trust and loyalty with customers: Demonstrating your commitment to data privacy fosters trust and encourages customer loyalty.

• Reduce the likelihood and impact of data breaches: Robust security measures minimize the risk of breaches and mitigate their potential damage.

• Gain a competitive edge: Being ahead of the curve on privacy regulations can attract privacy-conscious consumers and partners.

This is where organizations like CyberSecOp come in. We're not just your life raft in the storm – we're your skilled navigators, equipped with the expertise and resources to chart a course towards secure and compliant waters. Here's how we can help:

• Conduct thorough security and privacy assessments: Identify vulnerabilities and gaps in your current posture, providing a clear roadmap for improvement.

• Develop and implement tailored security and privacy programs: Create solutions that meet your specific needs, industry regulations, and global reach.

• Stay ahead of the curve with ongoing monitoring and updates: Our team keeps you informed of evolving regulations and industry best practices.

• Respond effectively to data breaches: Minimize the impact of breaches and ensure compliance with reporting requirements.

• Offer expert guidance and support throughout your journey: Our team of experienced professionals is here to answer your questions and address your concerns.

Don't wait for the next regulatory wave to hit. Contact CyberSecOp today and let us help you navigate the ever-changing seas of data privacy and cybersecurity with confidence. Together, we can ensure your business sails smoothly towards a successful and secure future.

What is Your Organization's Cybersecurity Game Plan?

What is Your Organization’s Game Plan for Optimizing Cybersecurity Management?

Like the teams prepping for Sunday's Big Game, cybersecurity and risk management require a playbook to efficiently manage multiple frameworks. Most organizations are going on the offensive with their defensive measures in regards to cybersecurity and risk management. CyberSecOp cybersecurity programs empower your security maturity and culture by utilizing multiple security frameworks to address expanding requirements.

 Why is Offensive Defense Important?

Threats like ransomware give attackers the ability to shut down your access to devices, databases and other data streams. While large corporations and government agencies are in attackers’ crosshairs to yield big payouts, small and mid-sized businesses (SMBs) are not immune to ransomware risks.

Which Security Framework Can Reduce the Risk of Ransomware?

CyberSecOp provides cyber risk and advisory programs to identify the right security framework for your organization and industry.   

How CyberSecOp Assists Our Customers:

To protect against ransomware, CyberSecOp assists clients to implement NIST Cybersecurity Framework and NIST SP 800-207, Zero Trust Architecture to help understand, manage and reduce your cybersecurity risks like phishing and ransomware attacks.

CyberSecOp assist our customers with:

Benefits

Reduce the potential of ransomware encryption  

• Experienced Security & IT leader

• Reduce risk

• Build risk assessment program

• Third-party risks, privacy compliance and data processing mapping.

• Response and mitigation strategies

• Security monitoring (SOC & MDR)

• GRC platform that incorporates all stages of processing in the risk operational workflow.

• Monitor and report on combines and individual frameworks

CyberSecOp cybersecurity experts have been involved in thousands of audit processes at organizations worldwide. Our team has experience with the following framework and regulatory requirements: NIST, PCI, HIPAA, GLBA, SOC, FISMA, GDPR, NYDFS, ISO 27000, SEC, FINRA and others.

Cyber Threats Require New Approach to Design Flaws and Risk

Now that the year is in full swing, and you’re only left with the distant memories, COVID, and cyber security, what are your business cyber objectives for 2022?

Ours goals are to continue helping businesses:

1. Improving security for everyone, by doubling the amount or organizations we helped last year (100% our client shows no evidence of a data breach)

2. Offer competitive pricing, to make security an attainable goal for every organization

3. Reduce cost and increase security by implementing more automation and artificial intelligence 

Cyber threats are a real threat to all modern businesses, with the evolution of technology in all sectors. Malicious cyberattacks in 2021 forced shutdown of many business operations at an average downtime of a month.  According to multiple reports, the amount of companies who ended paid hackers grew by 300% in 2020, and 200% in 2021. The businesses that were victimized had two options, pay the ransom or go out of business.

Email is the most popular attack vector

Email is still a top attack vector cybercriminal use. A majority of data breaches are caused by attacks on the human layer, but email hacking is much more than phishing.

Top 3 email attacks

1. Most wire frauds are successful over email communication; the focus trust, in most case the threat actor would be in the middle of a communication between two are more parties. This allows the threat actor to control the conversation, and change wire information.

2. Threat actor’s setup email rules to keep persistent connections and visibility to gain insight into the organization long after all passwords have been changed.

3. Threat actors add external emails to distribution groups to keep persistent connect and gain continuous insight into the organization in preparation for their next attack.

Double and Triple Extortion

Cybercriminal groups identified by the FBI responsible for most incidents are known for conducting aggressive “double/triple extortion” ransomware attacks once they have gained access to a network.

In double extortion attacks not only is the victim organization’s data rendered inaccessible until a ransom is paid but the criminals may further monetize the ransomware attack by coupling it with a Distributed Denial of Service (DDoS) attack or selling the stolen data onto other criminal groups.  In some cases, if the organization is not careful, hackers use email, phone, or text to deceive  employees into helping them commit wire fraud.  

Providing security is challenging in any industry, whether you’re talking about agriculture, automobiles, furniture, financial services, or educational. It requires special equipment and knowledge around how things can fail in the field, and a disciplined approach to executing tests that reflect real-world conditions as much as possible.

This is where CyberSecOp can help your organization

We are an independent third-party testing, and compliance readiness firm, operating only within the cybersecurity industry. With our comprehensive suite of services and solutions our team can provide continuous testing, security program development, security tabletop exercise, security awareness training to reduce risk and increase critical testing against sensitive systems, using real-world conditions.

What is a Zero Trust Security Architecture?

What is Zero Trust Security?

Zero Trust Security, also referred to as Zero Trust Networks or Zero Trust Architecture, is a security concept with one basic principle: don’t automatically trust anything to access your data, whether it’s connecting from outside your organization or within. Implementing Zero Trust involves various technologies, policies, and processes that help you better respond to the sophisticated approaches cybercriminals are using to gain access to sensitive data.

CyberSecOp’s Zero Trust Security service offers a comprehensive solution to secure all access to your applications and environment from any user, device, and location. Zero trust is a security model based on maintaining strict access controls.

With the recent and very public surge of cyber incidents affecting businesses and critical infrastructure, you may have heard the phrase ‘Zero Trust’ regarding cyber security and protecting business assets. So what is Zero Trust? Put Zero Trust is a model of thought that centers around never trusting any device, application, or person, regardless of whether they are attempting to connect from inside or outside the network. This methodology is gaining more and more traction as cloud application usage increases and the permanent shift to remote work is further implemented.

 Zero trust is a strategy where everything (People, Data, Sessions, Devices, Applications) is treated as suspicious regardless of whether it's inside or outside the network. Essentially it is a ‘default deny’ posture, even for users within the organization. Instead of ‘Trust, verify the organization ‘Never Trusts, Always Verify.’ This is not accomplished by one tool but rather by policy, procedure, and means. Zero trust also focuses on Least Privilege- a Methodology that states no user should have more rights and permissions than what is needed to perform their work.

Zero Trust focuses on 5 pillars

1.       Device Trust

2.       User Trust

3.       Transport and Session Trust

4.       Application Trust

5.       Data Trust 

CyberSecOp can transform your business into a Zero Trust model by focusing on the tools, policy, and procedures to protect these five pillars and substantially decrease the odds of a successful breach. 

ZERO TRUST SERVICES & ZERO TRUST PLATFORM

OVERVIEW: MANAGED SECURITY - MDR SERVICES - MANAGED COMPLIANCE

With Zero Trust network access for your private apps and systems, you no longer have to choose between user experience and security. CyberSecOp Managed Zero Trust services were built with a new approach that directly creates zero trust connections between the users and the applications to solve this unique challenge. As a scalable, cloud-native platform, it enables digital transformation by securely connecting users, devices, and applications anywhere without relying on network-wide access. This platform is delivered by five key architecture attributes unique to the CyberSecOp Managed Zero Trust services. Together, they enable organizations to provide strong security and a great user experience to their employees and customers.

ZERO TRUST SECURITY SOLUTION & SERVICES

When all employees have the same access privileges, the network is vulnerable. VPNs may provide adequate security for on-premise resources, but only Zero Trust solutions offer the user-based access rules required for proper cloud security.

Our Zero Trust solutions and services utilize multi-layered cybersecurity protection to transform your business with cybersecurity orchestration, automation, cybersecurity consulting, cloud, and managed security services. We implement a comprehensive approach to secure and protect businesses from cyber threats. Our cybersecurity services cover all the following areas needed for a zero-trust secure environment:  Cybersecurity Program Strategy, Risk Management, Risk Assessment, Threat Intelligence, Incident Response, Advanced Malware & Ransomware Protection,  Perimeter Security,  Application Assessment, & Security Monitoring Services. We know where you are and how to protect your organization with a cybersecurity gap analysis to identify a more precise road map and a more robust cybersecurity program.

Zero Trust Cybersecurity Benefits and More

Zero trust networks, of course, extend beyond security. They are also inherently agile, a vital benefit for an increasingly remote workforce. As massive remote crews put unprecedented strain on cloud resources, the more stability and resilience you can build into your architecture, the better. Rather than backhauling remote data to a static data center, zero trust applications connect directly into your network from outside the perimeter, which helps free up bandwidth for DevOps and access business-critical cloud services.

ADOPT OUR ZERO TRUST SECURITY MODEL DEFENSE APPROACH

AUTOMATED PKI LIFECYCLE MANAGEMENT ZERO TRUST

The automated PKI lifecycle management platform enables Zero Trust by utilizing  Public Key Infrastructure (PKI) certificates and key pairs, strengthening digital identities, and securing the connections between entities beyond the firewalled network architecture. In this age of digital transformation, the Zero Trust model increases the need for a consolidated, automated, and modern approach to PKI.

SECURE INTERNET GATEWAY

Control desktop, laptop, and mobile device access to malicious and inappropriate websites.

SECURE WEB GATEWAY

Protect against every kind of threat and ensure strict compliance with policies without slowing down your users.

ANTI SPAM & EMAIL GATEWAY

Secure Email Gateway protects organizations and employees from spear-phishing, malware, spam, and zero-day attacks. To ensure zero trust by removing spam and malicious email traffic before it enters your network to ensure zero trust.

ADVANCED ENDPOINT PROTECTION

Secure all your servers, desktops, laptops, and mobile devices from known and unknown malware–without requiring signatures or updates.

WEB APPLICATION FIREWALL

Powerful, real-time edge protection for

web apps and websites providing advanced

filtering, security, and intrusion protection.

SIMPLIFY COMPLIANCE REPORTING

Meet compliance requirements with no extra work. CyberSecOp Consultants have you covered, delivering streamlined reports of system access across the organization and zero trust technologies. 

CYBER SECURITY OPERATIONS CENTER

Your always-on certified cybersecurity professionals team provides 24/7/365 surveillance and remediation services to ensure zero trust.

DATA LOSS PREVENTION

Monitor and control the movement of sensitive and confidential data across the network. Implement a ‘zero-trust’ data loss prevention (DLP) strategy utilizing activity, system-access, schedule, and content-based rules to ensure zero trust.

SINGLE SIGN-ON

A secure cloud single sign-on solution that IT, security, and users will love. Single sign-on solutions can quickly connect to and sync from identity stores including AD, LDAP, HR systems, and other third-party identity providers to ensure zero trust.

MULTI-FACTOR AUTHENTICATION

Secure, intelligent access to delight your workforce and customers. Secure your accounts and apps with a robust multi-factor authentication solution to keep the right people in and the wrong people out. Protect all your resources, including customer-facing and enterprise apps that store your most sensitive data to ensure zero trust.

SECURITY INCIDENT EVENT MANAGEMENT

We are providing actionable intelligence leveraging current events and data. Our SIEM collects logs and circumstances of the network traffic and web assets, security devices, operating systems, applications, and databases and reviews the vulnerabilities using artificial intelligence to process to ensure zero trust.

REMOTE MONITORING AND MANAGEMENT

Remote Monitoring and Management (RMM) is remote monitoring software that allows you to remotely monitor and manage endpoints, computers, mobile devices, and networks from a centralized console to ensure zero trust.

MANAGED CYBERSECURITY SERVICES

CyberSecOp is a cybersecurity service provider offering a range of solutions related to protecting computer systems within an organization. Cybersecurity is a constantly evolving industry created in response to hacking, viruses, and other personal and business data threats. CyberSecOp-managed cybersecurity services will provide your business with expertise in the three stages of business cybersecurity protection services: assessment, security program implementation, and governance. We implement external and internal cybersecurity solutions with advanced IT security software and hardware solutions. CyberSecOp provides several cybersecurity tools to ensure end-to-end cybersecurity protection. We also offer IT outsourcing services to address your company’s information technology needs.

End to End Cybersecurity Services

We offer cybersecurity and strategic advisory consulting, incident response, design, and deployment services. We will implement a security program strategy to align information security policy, security controls, and plan with business goals.

LEADING MANAGED CYBERSECURITY SERVICE PROVIDER

CyberSecOp is a leader in managed cybersecurity services. Our cybersecurity team will implement a secure framework and constantly monitor and protect your business from cyber threats. Our cybersecurity experts integrate business context intelligence, threat data, and cybersecurity insights to protect your assets and data. The risk scene develops with rising rates; it takes more oversight with cybersecurity services to effectively ensure your organization is secure from cyber threats. Our team will work with your firm to identify any risks or threats it may face. We will deliver recommendations highlighting security flaws in your environment and the immediate steps to these issues.

CYBERSECURITY AS A SERVICE (CSAAS)

CyberSecOp offers proactive Cybersecurity as a Service (CSaaS) to mitigate cyber risk. Every business needs defense in-depth, includincludessecurity solutions and cybersecurity experts who can deploy and monitor them. 

Transform and strengthen your cybersecurity to become proactive, effective and resilient. Cybersecurity is a core business requirement, providing a secure foundation to transform your enterprise and support your business. Ready to see how CyberSecOp Cybersecurity Services can help?

Why a vCISO may be right for your organization cyber security

Since the start of the COVID19 pandemic, several societal changes have shaped how firms function in the current climate. Many firms have implemented a work-from-home model to help prevent the spread of the novel coronavirus and ensure employees are comfortable with their surroundings. What many organizations didn’t anticipate are the cyber security-related risks.

Once employees leave the security of their offices, they increase their attack surface and open themselves and their employer to attendant Information Security vulnerabilities that may come with working remotely. Remote work changes have prompted heightened instances of cyber attacks that have worsened in style and quantity over time. The pandemic has created the perfect environment for hackers to attack with more accuracy, and with greater cost to the firm, than ever. Learn more about remote working in relation to the pandemic. 

How a vCISO can help protect your firm from cyber attacks

A vCISO can function as an additional set of eyes that constantly monitors your firm’s security operations. The additional security will aid in preventing possible security breaches. A vCISO can also bring expertise to assist in developing a strategy to strengthen your firm’s security program.

The benefits of a vCISO: 

• A board-level cyber security consultant fulfilling the CISO responsibilities 

• A team of security risk assessment experts 

• Employee security awareness education 

• Dark Web Monitoring 24/7/365

• Full enterprise risk management for any required compliance 

• Comprehensive third party/vendor  management 

• Compliance support for NIST, ISO, GDPR, CCPA, NYDFS, PCI/DSS among others

• A more affordable approach as opposed to hiring a full-time CISO

• Eliminate internal training costs and have our seasoned experts handle your security 

CyberSecOp offers vCISO services. Click here to learn more.

New Remote Attack on Workforce Asks For Consent

A newer type of attack that is gaining momentum on the WFH revolution is Consent Phishing, which seeks the user’s permission as opposed to password.

With today’s widespread use of cloud applications like Webex, Zoom, and Box for increased productivity, the average person has no doubt ran across an application that asks for consent. Attackers have leveraged this familiarity to create malicious applications that request permission for access to sensitive data. Once the user has granted the application access it’s Game Over.

How it works

While each attack method varies, it usually comes down to the following steps:

1. Threat actor registers a malicious app with an OAuth 2.0 provider, such as Azure Active Directory, AWS, or Google Cloud

2. The app is configured in an inconspicuous way that makes it seem legitimate

3. The threat actor gets a link to pop up for the user which may be done through conventional email-based phishing, by compromising a non-malicious website

4. The victim clicks the link and is shown the familiar-looking consent prompt asking them to allow the application permission to sensitive data

5. Once the user clicks accept, they have granted the application permissions to access sensitive data

6. The malicious application receives an authorization code, which it then redeems for an access token, and potentially a refresh token

7. The access token is used to make API calls on behalf of the user

How to protect against this type of attack

• Advanced endpoint protection

• User awareness, if the application consent prompt contains misspelling or grammar errors, those are telltale signs that it may be malicious

• Configure your organization to only allow applications that are published and verified

• Configure policies to whitelist only certain apps for use

Author: Carlos Neto

Achieve an Effective Security Awareness Program

For any company, especially technology-oriented ones, being aware about the cyberthreat landscape is critical. There is often the mindset that most cyberattacks can be warded off by procuring and implementing the latest security technologies, and relying on consultants and internal resources to police implementation.

While this passive strategy may yield a certain level of effectiveness, it also takes a high level of active, participatory security awareness on part of both employees and management in order to 100% fortify the lines of defense around the business or corporation.

STEPS TO ACHIEVE AN EFFECTIVE SECURITY AWARENESS PROGRAM

1.     The Major Orienting Components – A comprehensive, participatory information security awareness program should have as its three foundational pillars the principles of confidentiality, integrity, and availability.  While the first two terms speak for themselves, the third is often misapprehended.  Here, it refers to the organization maintaining a comprehensive system of controls over information security such that employees can be assured of having access to all information necessary to perform their roles without risk of breach.

2.     The Protection of Corporate Resources - “Corporate resources” does not just refer to digital assets — it also refers to physical assets, such as paper documents. A security awareness checklist should include the proper usage of document-shredding machines and how the shredded documents should be disposed of.

3.     Protection of Corporate Facilities - Employees should be trained not only in how to look for suspicious behavior from the outside, but from the inside as well.  This will ensure against unauthorized personnel gaining access to the premises for purposes of mounting internal attacks against the information infrastructure.

4.     The Formal Security Awareness Training Program – The corporation should maintain a comprehensive security awareness training program and all employees, irrespective of position with the organization and/or function, should regularly participate.

5.     Determining Levels of Responsibility and Segregation of Duties – All employees involved in the day to day management of security over the corporation’s digital and physical information assets should have their roles clearly defined and responsibilities enumerated and documented in a comprehensive ‘R & R’ policy.

CyberSecOp Security Awareness Courses specializes in helping employees understand the mechanisms of spam, phishing, spear-phishing, malware, and social engineering and are able to apply this knowledge in their day-to-day job. Our Security Awareness training solutions effect meaningful, sustainable changes in any workforce. With CyberSecOp Security Awareness Training, employees are not just aware of the dangers presented by an ever-changing threat landscape: they’re empowered to protect your organization from them.

AUTHOR: RICH FIORE

Comodo and CyberSecOp Announce Strategic Partnership

Comodo and CyberSecOp Announce Strategic Partnership

after Award-Winning MSSP Dropped Leading Competitor

Clifton, NJ – June 30, 2020 – Comodo and CyberSecOp today announced their strategic partnership. CyberSecOp, an award-winning, independent security consulting firm providing a range of information security consulting services, has partnered with Comodo to expand its security services offering for its customers. Comodo displaced a leading competitor.  

 “We focus on the customer experience—delivering what our customers want when they want it. That is our commitment and we take it seriously” said Jeffrey Walker, Chief Information Security Officer at CyberSecOp. “We needed to expand our security operations to fit the growing demand from our customers. Once we saw Comodo's complete SOC as a platform (SOCaaP) offering for MSSP partners and its ingenious auto containment technology, we knew they were the right partner for us. Occasionally, we have a partnership that our firm can't survive without, and we are confident that this is the relationship we are building with Comodo.”

CyberSecOp chose Comodo because it’s the world’s only complete, next-gen SOC-as-a platform offering — which includes people, process, and technology. The patent-pending auto containment technology is the world’s only active breach protection that renders ransomware, malware or cyber-attacks useless.  In addition, the platform saves MSSP partners time and money, without zero capital outlay.

“Our partners and the channel are in our DNA. Comodo is a partner-centric company and our goal is to make sure our MSSP partners and their clients are secure and happy,” said Alan Knepfer, President and Chief Revenue Officer at Comodo. “We are proud that such a respected MSSP has selected us. Our partners expect the best from us, and this allows us both to take our high standards to the next level.”

About CyberSecOp

CyberSecOp cybersecurity consulting services was founded by two information security professionals, and a managed services IT firm. They recognized the need for cyber security consulting services for small and medium-sized companies, and that small and medium businesses need to be secured with an information cyber security program. We provide Managed Security Services, Cyber Security Consulting, Security Consulting VISO Services, and Security Staffing. 

Mission: To redefine customer business equity with best-of-breed transformation, technology, and talent.

Vision: Empower our customers to focus on core business competence through innovative and competitive IT and secure business process outsourcing.

About Comodo Security Solutions, Inc.

Comodo delivers next generation cybersecurity solutions to protect businesses, schools, and government organizations in today’s risk-filled business environment. Headquartered in Clifton NJ, Comodo’s global development team and threat intelligence laboratories deliver innovative, category-leading, solutions for a company’s endpoints, network boundary, and internal network security.

Thousands of companies and organizations rely on Comodo’s technology to authenticate, validate, and secure their most precious asset—information—and to combat constant cyberattacks and threats like ransomware from wreaking havoc on a global scale.

www.comodo.com
sales@comodo.com
+1 888 551 1531

So, What Exactly Is the Dark Web, Anyway?

The first time I heard the term ‘Dark Web’ was in the context of a case of misappropriated identity.  A close relative of mine had begun receiving all sorts of communications from credit card companies and debt collectors concerning delinquencies that they were completely unfamiliar with.  One even included an attempt at collecting back premises rent for an apartment in Dallas, Texas where my relative had never visited in their life.  After spending months fighting off financial claims and trying to repair their credit history, my relative contracted a computer security professional to perform a forensic investigation of their home PCs.  It was ultimately discovered that some or all of the data breach enabling the identity theft had been the outcome of a fairly sophisticated spear-phishing attack combined with the installation of a key logger agent.  The forensics also revealed that much of their Personal Identifying Information had migrated to the Dark Web and was presently freely available to whomever-or whichever entity-might be interested.

Dark Web and how it functions

Dark Web, I thought.  Huh.  I’ve heard of the Dark Web but don’t know much about what it is or more specifically, how it functioned.  Heretofore I’d (wrongly) believed it was composed of a bunch of gamers sharing logins to cloud gaming services along with the ever-present and always thriving market for pornography.  My investigatory efforts yielded that the Dark Web is so, so much more, however; and I thought it was important to share my findings to clear up any popular misconceptions of which there is legion.  Therefore, I’ve decided to put together a brief post that provides the nuts and bolts of what’s become an increasingly important cog in the global economy for ill-gotten bits and pieces of data and information.  It turns out, the Dark Web wasn’t nearly as elemental as I’d initially suspected.

The Dark Web is a collection of thousands of websites that use anonymity tools to hide their IP addresses. While it's most famously been used for black market drug sales and even child pornography, the Dark Web also enables anonymous whistleblowing and protects users from surveillance and censorship.  Readers will recall that the Dark Web played an intermediary role in WikiLeaks dissemination of certain confidential U.S. Department of Defense documents related to the conflicts in Iraq and Afghanistan.

Who created the Dark Web and how can it be assessed?

The majority of Dark Web sites use the anonymity software Tor with was created by the U.S. Department of Defense, though a smaller number also uses a similar tool called I2P. Both of those systems encrypt web traffic in layers and bounce it through randomly-chosen computers around the world, each of which removes a single layer of encryption before passing the data on to its next hop in the network. In theory, that prevents any spy—even one who controls one of those computers in the encrypted chain—from matching the traffic’s origin with its destination.  In layman’s terms-traffic on the Dark Web is untraceable.

Though the Dark Web is most commonly associated with the sale of drugs, weapons, counterfeit documents, and child pornography, not everything on the Dark Web is quite so “dark.” One of the first high profile Dark Web sites was the Tor hidden service WikiLeaks created to accept leaks from anonymous sources.  Even Facebook has launched a Dark Web site aimed at better catering to users who visit the site using Tor to evade surveillance and censorship. The Dark Web is also a vehicle for hackers to buy and sell personal information such as names, addresses, social security numbers, credit card information, etc. The more information they obtain from the unsuspecting victim, the higher the price.

Can Dark Web provide privacy

Just how completely Dark Web users can evade the surveillance of highly-resourced law enforcement and intelligence agencies, however, remains an open question. The FBI and EUROPOL have both launched successful Dark Web investigations aimed at stopping human trafficking, identity theft, and drug smuggling, and in most cases, the agencies were able to identify the threat actor by setting up relays and scripts on websites they frequently visit.  It's also possible that the agencies employed sophisticated DNS attacks on TOR servers or used other exploits; then again, it’s also possible they were able to rely on good old Human Intelligence-informants.  Everyone seems to have a price. 

So in summary, we know that the Dark Web exists, it’s a marketplace for all sorts of data and information exchange, not all of it legal or voluntarily disclosed.  The best way to ensure you don’t wind up on the wrong side of information exchange?  Secure your information systems, be very, very judicious in responding to emails and if you have any questions or concerns, contact a licensed information technology security professional.  The stakes are high, and only getting higher.

Author: Rich Fiore