There are more than one billion web pages on the Internet, and 4.8 billion people around the world use the Internet daily. But did you know that only 10% of websites on the Internet are indexed by Google, Yahoo, Bing, and other search engines and accessible to the general public? These websites are called the “surface web,” and the other 90% of websites are the “deep and dark web.” These are the layers of the Internet.

Think of the internet as the ocean, with the surface web as the top layer and visible for miles and miles. The deep web, then, is the deeper part of the ocean just below the surface. This is also accessible to people but requires a bit of work to access. The dark web is the very bottom of the ocean and is only accessible to a small number of people who know exactly how to get there and has the resources and time to do it.

Let’s take a look at what kinds of web pages are on each layer (surface, deep, and dark), and what that means to the general Internet user.

The surface web includes websites that we are all familiar with and likely access on a daily basis. This is the portion of the Internet that is readily available to the general public and searchable with standard web search engines like Google, Bing, and Yahoo. The surface web is also known as the “Visible Web.”

The surface web includes websites like:

• Social media sites including Facebook and Instagram
• Business websites such as Everound.com
• Wikipedia
• Online video sharing platforms like YouTube

Essentially, any website that appears after you complete a search on Google or another search engine is on the surface web.

Unlike the surface web, the deep web is part of the Internet where the contents are not indexed by search engines. The deep web is only accessible with some sort of authentication – a password or other means to be able to view the data and information. Using the previous ocean analogy, a person needs to have a resource to go “below the surface.”

Why is information on the deep web harder to access? Without authentication, that information is at risk for public consumption.

The deep web contains sensitive information like:

• Personal email accounts
• Content on your social media accounts
• Online banking and investments
• Private online databases
• Medical records and private health information
• Content contained within scientific and academic databases.

A lot of what exists on the deep web consists of personal information that you wouldn’t want to turn up in a web search — like your social security number or credit card information. This is private and could be misused in a data breach.

Remember, if you must provide a username, password, or some other type of authentication, the information you access is on the deep web.

The dark web IS a part of the deep web but cannot be accessed through traditional web browsers. The dark web is intentionally hidden on the Internet. Originally designed to share information and communicate by the US Military, the dark web is now accessed by others.

Accessing the dark web is not an easy task for the general Internet user. Regular browsers like Microsoft Edge or Google Chrome are unable to access dark web websites. The dark web uses what’s called The Onion Router (often referred to as Tor) hidden service protocol. “Tor” servers are undetectable from search engines and provide complete anonymity.

Although not all activity on the dark web is harmful, there is a growing population of cybercriminals that use the dark web maliciously and for illicit purposes. Some cybercriminals sell sensitive information on the dark web that can be used to exploit companies and can lead to identity theft. The dark web also is a place where some cyber attacks are planned.

Here are a few examples of what can be found on the dark web:

• Stolen information: If a company experiences a data breach because of a cybersecurity failure, there’s a chance the stolen data may be up for grabs on the dark web. Other stolen information for sale includes login credentials and hacked Netflix and Amazon accounts.
• Illicit substances: Believe it or not, you can find and purchase illicit drugs and toxic chemicals on the dark web. Prescription drugs are also available on the dark web.
• Dangerous and disturbing images and information: Unfortunately, the dark web can be a dangerous and ugly place. Human trafficking, pornography, gore, and counterfeit goods have found a home on the dark web.

The dark web can be a marketplace for illegal behavior. Companies with a cybersecurity plan in place that includes dark web monitoring can stay ahead of cybercrime on the dark web. Employee information can be at risk – logins and passwords are prime data that can be sold and transferred on the dark web.

Website hackers, too, find ways to compromise company networks through the dark web. A dark web monitoring MSP (managed service provider) can help you keep track of any information that may be compromised.

As a cybersecurity expert, Everound can help monitor the dark web for your small business or corporate enterprise. Through a strategic, customized and intentional approach, our team of cyber experts will create a cybersecurity dark web monitoring protocol that includes:

• Real-time alerts of dark web threats
• Routine scan of dark web for your business information
• Detection of compromised credentials including IP addresses, email addresses, and logins and passwords

Cybersecurity companies like Everound are experts at preventing cyber threats from infiltrating your business. With more than 30 years of experience, our team of cybersecurity professionals can recommend and implement data protection strategies and programs to help keep your information and your network safe from harm. Reach out today for your free cybersecurity risk assessment. We focus on IT so you can focus on your business.

In today’s highly volatile cyber environment, it’s important for business owners to have a clear, strategic approach to a cybersecurity risk management process. Managing cyber risk should be considered a priority for all business owners, regardless of size. While most media coverage focuses on cyber-attacks for large enterprise-level organizations, many small and medium businesses are also facing cyber-attack challenges.

Cyber-attacks are not random. In fact, if you know what to look for, there are usually signs of a planned or imminent cyber threat. Phishing emails and mentions of organizations on the dark web are both red flags that an organization is being targeted.

What should business owners do to stay ahead of potential cybersecurity vulnerabilities? The answer is the creation and implementation of a cybersecurity risk management plan. A cybersecurity risk management plan is the ongoing process of identifying, analyzing, evaluating, and addressing cybersecurity threats. The process is shared among an entire organization, not just members of the information technology team.

Because the cyber landscape is continually changing and new, sophisticated threats emerge daily, a risk management plan doesn’t completely provide a fail-safe for cyber threats. However, by establishing a risk management approach to cybersecurity, an organization can greatly reduce its risk by attending to the flaws, threat trends, and attacks that matter most to its business.

Let’s take a look at how to develop a cybersecurity risk management plan, the common cyber risk management frameworks, and the benefits of cybersecurity risk management.

When developing a cybersecurity risk management plan, many organizations approach the process with a 4-step model. First, organizations should identify risk, then assess the likelihood of the threat or risk actually occurring and what is its potential impact. The third step is to identify appropriate risk mitigation measures, and the final step is an ongoing monitoring program that includes risk response and security controls designed to evolve to address a shifting cyber threat environment.

Let’s explore each step of the process in more detail.

Step One: Identify Cybersecurity Risk

An IT risk is essentially any threat to your business data, IT infrastructure systems, and overall business processes. It is the potential for an unplanned, negative business outcome that comes as a result of a failure or misuse of information technology. When considering what your IT risks are, think of how a threat can impact your business and what would the consequences be?

When identifying risk, start with thinking about the threats, vulnerabilities, and consequences of an IT failure. Document each before moving to the next step.

• Threats: Threats are circumstances with the potential to affect an organization’s operations or IT assets negatively. This can occur through unauthorized access to IT information systems and can occur through human error, cyber-attacks, IT configuration failures, and even natural disasters such as a hurricane, tropical storm, or black out.
• Vulnerabilities: What are the weaknesses in the information system, security procedures, internal controls or implementation from a threat? In addition to internal vulnerabilities, list the external weak points such as supply chains and vendor relationships.
• Consequences: Consequences are any of the adverse results that happen when a threat exploits a vulnerability. What costs – both hard and soft – are at risk and would be a consequence if a cyber threat was successful? Some of the costs include revenue, destroyed or lost information, and customer trust.

Step Two: How to Assess Risk

After cybersecurity risks are identified and documented, the next step is to assess your level of risk to determine what level of cybersecurity measures should be implemented. Which risks are the greatest? Which have low consequences? Assessing risk can help you determine how to build your risk management plan.

For reach risk, conduct an impact analysis that includes:

• Name all assets
• Prioritize each asset
• Identify all possible threats
• Identify vulnerabilities
• Determine the likelihood of a threat event
• Conduct an impact analysis to estimate the cost impact

The results of your risk assessment will be a guide to inform risk management decisions and risk response measures in the future.

Step Three: Identify and Implement Cybersecurity Risk Mitigation Measures

Now that you’ve intentionally identified IT risks, how can you mitigate each risk to minimize the impact of a cyber-attack? Depending on the outcome of the previous steps, there are several options to help manage cybersecurity risk including:

• Cybersecurity training: Most successful cyber-attacks are the result of human error. Cybersecurity training programs for staff and stakeholders is a great tool to help mitigate risk.
• Updating software: Updating software is an important part of cybersecurity. Outdated software lacks patches if vulnerabilities are discovered and can fall prey to advanced cyberattacks. This poses several security risks, both due to human malice and the chances of information system failure.
• Multi-factor authentication (MFA): MFA is a security feature that dramatically improves account security. MFA, also referred to as two-factor authentication, adds an additional layer of security to protect organizational data and assets.
• Data backup: Data backups are an essential part of a cybersecurity risk management plan as they allow for data protection and recovery in the case of a successful attack. There are different strategies and resources available for data backup, most including cloud services.
• Endpoint protection:  Every single device that is connected to your network is an entry point to your business. Endpoint protection works by examining files as they enter and leave devices on your network. An endpoint security system is a software program that is centrally managed by an administrator and tracks threats in real-time.
• Dark web monitoring: Company email addresses, validation credentials, account information, and other important business data can be compromised or sold on the dark web. Adding a dark web monitoring service to your cybersecurity plan helps protect yourself from a data breach.

Step Four: Implement Ongoing Monitoring

After putting cybersecurity risk mitigation measures in place, most business owners have a false sense of security. After all, they’ve identified risks and put security measures in place – shouldn’t that be enough?

Unfortunately, cybercriminals and cybercrime evolves and change rapidly. Ongoing monitoring can help ensure internal controls keep up with changing IT risks.

When building a cyber risk management process, there are several frameworks that help businesses adhere to industry and regulatory best practices. A cybersecurity framework provides a common language and set of standards for IT professionals in varying industries. Having a framework in place makes it easier to define the processes and procedures your business must take for cybersecurity.

Some of the most popular frameworks include:

• NIST Cybersecurity Framework (CSF): Drafted by the National Institute of Standards and Technology (NIST), this framework addresses the lack of standards when it comes to cybersecurity across the private and public sectors. NIST CSF provides a uniform set of rules, guidelines, and standards for organizations to use across industries.
• DoD Risk Management Framework (RMF): The Department of Defense (DoD) Risk Management Framework (RMF) is the set of standards that DoD agencies use to assess and manage cybersecurity risks. This framework can be applied to other industries and breaks down a cyber risk management strategy into six steps.
• ISO/IEC 27001 and 27002: Created by the International Organization for Standardization (ISO), ISO 27001 and ISO 27002 are considered the international standards for validating a cybersecurity program. Companies can receive ISO certification by following the framework outlined.
• FAIR: The Factor Analysis of Information Risk (FAIR) is a cyber risk framework developed by The Open Group to help businesses understand, measure, and analyze risk to help business leaders make well-informed decisions about their business risk and their cybersecurity practices.

An intentional and strategic cybersecurity risk management program can reduce the risk of cyber criminals obtaining sensitive company information. There are countless benefits to a thought-out, intentional approach to cybersecurity including:

• Phishing detection
• Brand protection
• Fraud protection
• Sensitive data leak monitoring
• Dark web activity
• Automated threat mitigation
• Minimizing supply chain risks

Unsure where to start with a cybersecurity risk management plan? A managed services provider (MSP) specializing in cybersecurity can help you create a framework to protect your business from cyberthreats.

Cybersecurity companies like Everound are experts at preventing cyber threats from infiltrating your business. With more than 30 years of experience, our team of cybersecurity professionals can recommend and implement data protection strategies and programs to help keep your information and your network safe from harm.

We offer a free cybersecurity risk assessment that can help you start developing your cybersecurity risk management program. We will take a deep dive into your potential security threats and recommend programs that can help you reduce risk. Reach out today for a free consultation. We focus on your IT, so you can focus on your business.