Menu
Security company scours 'Dark Web' for stolen data

Security company scours 'Dark Web' for stolen data

Companies are looking for new ways to monitor the brisk trade in stolen information on underground forums

Alex Holden's company, Holden Security, has expanded its business to monitor password-protected hacking forums for its clients to see if they've been victims of a data breach.

Alex Holden's company, Holden Security, has expanded its business to monitor password-protected hacking forums for its clients to see if they've been victims of a data breach.

Alex Holden, founder of security company Hold Security, is in the business of bringing companies bad news.

Holden often reaches out to organizations, alerting them that their valuable data is circulating on underground hacker forums. These days, that's pretty frequent.

Holden's company, which focuses on penetration testing and auditing, recently expanded into monitoring the so-called dark or deep web, which refers to password-protected forums where cybercriminals sell or trade the data they've stolen.

"We went from being reactive and working a breach and getting the information for the client to monitoring as much of the Internet as possible and bringing the data into our data centers and looking at it," he said.

Data breaches are costly for organizations. A Symantec-sponsored survey released in May conducted by the Ponemon Institute found the average cost to recover from one was highest in the U.S. at US$5.4 million, followed by $4.8 million in Germany and $4.1 million in Australia.

Holden's research in part contributed to the revelation last month that three major data brokers -- LexisNexis, Kroll Background America and Dun and Bradstreet -- had been victims of persistent breaches, which leaked consumer and business data as reported by security analyst and journalist Brian Krebs.

Those public disclosures, however, are just the tip of iceberg, as hackers dig deeper and deeper into company networks, Holden said in an interview Tuesday. His company has profiles on as many as 10,000 data thieves worldwide, a formidable, clever force that is causing security headaches worldwide.

Earlier this month, Hold Security launched a subscription service called "Deep Web Monitoring," where the company's analysts search secret forums and let companies know if their data has been compromised. If a company isn't working with Hold Security, Holden said he will sometimes approach the organization's legal team to let them know there's a breach.

Holden, who also is chief information security officer for his company, has a small team of analysts, mostly based in the U.S. They look for email addresses, login credentials, employee and customer names as well as any other data circulating on forums and chat channels. Hold Security's clients are predominantly in financial services, the medical industry and e-commerce businesses.

Just in the last month alone, the company's analysts came across more than 100 million stolen user IDs and passwords, Holden said.

If the data appears to match that of one of its clients, a delicate negotiation may take place. Some companies will give the nod to Hold Security to negotiate to prevent the data from becoming public.

"We often try to communicate with the cybercriminals and say 'Alright, I know you stole this data, but I want exclusive rights'," Holden said. "In some cases, we were successful doing that."

Other companies may opt for a more defensive strategy. If a company's network is compromised, some have chosen to instead seed fake data on their systems. Malware that periodically collects database information would suck up the bogus data.

"The bad guys are not really good at keeping backups of the original data," Holden said. In one case, Holden said "we were able to taint the data that was being stolen."

Cybercriminals are also in competition with one another. There have been instances of one hacker ratting out another to Holden's analysts in an attempt to shut down their competitor.

"There is no kinship between certain thieves," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securitydata breachHolden Securitydata protectionmalware

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments