Menu
Security company scours 'Dark Web' for stolen data

Security company scours 'Dark Web' for stolen data

Companies are looking for new ways to monitor the brisk trade in stolen information on underground forums

Alex Holden's company, Holden Security, has expanded its business to monitor password-protected hacking forums for its clients to see if they've been victims of a data breach.

Alex Holden's company, Holden Security, has expanded its business to monitor password-protected hacking forums for its clients to see if they've been victims of a data breach.

Alex Holden, founder of security company Hold Security, is in the business of bringing companies bad news.

Holden often reaches out to organizations, alerting them that their valuable data is circulating on underground hacker forums. These days, that's pretty frequent.

Holden's company, which focuses on penetration testing and auditing, recently expanded into monitoring the so-called dark or deep web, which refers to password-protected forums where cybercriminals sell or trade the data they've stolen.

"We went from being reactive and working a breach and getting the information for the client to monitoring as much of the Internet as possible and bringing the data into our data centers and looking at it," he said.

Data breaches are costly for organizations. A Symantec-sponsored survey released in May conducted by the Ponemon Institute found the average cost to recover from one was highest in the U.S. at US$5.4 million, followed by $4.8 million in Germany and $4.1 million in Australia.

Holden's research in part contributed to the revelation last month that three major data brokers -- LexisNexis, Kroll Background America and Dun and Bradstreet -- had been victims of persistent breaches, which leaked consumer and business data as reported by security analyst and journalist Brian Krebs.

Those public disclosures, however, are just the tip of iceberg, as hackers dig deeper and deeper into company networks, Holden said in an interview Tuesday. His company has profiles on as many as 10,000 data thieves worldwide, a formidable, clever force that is causing security headaches worldwide.

Earlier this month, Hold Security launched a subscription service called "Deep Web Monitoring," where the company's analysts search secret forums and let companies know if their data has been compromised. If a company isn't working with Hold Security, Holden said he will sometimes approach the organization's legal team to let them know there's a breach.

Holden, who also is chief information security officer for his company, has a small team of analysts, mostly based in the U.S. They look for email addresses, login credentials, employee and customer names as well as any other data circulating on forums and chat channels. Hold Security's clients are predominantly in financial services, the medical industry and e-commerce businesses.

Just in the last month alone, the company's analysts came across more than 100 million stolen user IDs and passwords, Holden said.

If the data appears to match that of one of its clients, a delicate negotiation may take place. Some companies will give the nod to Hold Security to negotiate to prevent the data from becoming public.

"We often try to communicate with the cybercriminals and say 'Alright, I know you stole this data, but I want exclusive rights'," Holden said. "In some cases, we were successful doing that."

Other companies may opt for a more defensive strategy. If a company's network is compromised, some have chosen to instead seed fake data on their systems. Malware that periodically collects database information would suck up the bogus data.

"The bad guys are not really good at keeping backups of the original data," Holden said. In one case, Holden said "we were able to taint the data that was being stolen."

Cybercriminals are also in competition with one another. There have been instances of one hacker ratting out another to Holden's analysts in an attempt to shut down their competitor.

"There is no kinship between certain thieves," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securitydata breachHolden Securitydata protectionmalware

Featured

Slideshows

Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments