The Dark Web is notorious and widely known in the world at large. A decade ago, this might not have been the case. 随着网络攻击的加速，全球各地的不法分子都在寻求更快地与非法商品和信息的买家联系, the term Dark Web has entered the lexicon in a prominent way.
According to a description from Tulane University, 美国国防部利用暗网作为匿名交流的手段. Its talent for keeping activity anonymous remains, but now protects malicious actors instead of innocent citizens of a given country.
The Dark Web is a place where sellers of illegal drugs, identities, information (passwords, account numbers, etc.) weapons, 许多其他非法形式的实物材料和数字信息寻求跨境贩运这些材料. In terms of cybersecurity, the Dark Web is a place where Ransomware-as-a-Service kits and phishing methodologies are traded and leveraged daily.
We really can’t put too fine a point on this fact: When it comes to cybersecurity in particular, 暗网是攻击者获取破坏您的组织和业务所需工具的来源. Accordingly, it’s become paramount for security teams all over the world to respond faster than ever.
The types of darknets that can access the Dark Web number many. A darknet is essentially the means by which a person accesses content on the Dark Web. Let's take a look at some of the more common examples of available darknets:
In attempting to access the Dark Web, there’s an invisible line that a person acknowledges they’re crossing – or maybe they don’t. Either way, no one is accessing the Dark Web with a sense of optimism.
Tor, for example, uses multi-layered encryption to create anonymous communication over a computer network. Unpacking these layers of encryption is sort of like peeling an onion.
This is where things might get just a bit confusing, as the Dark Web is nearly synonymous with illegal activity. Indeed, the vast majority of activity taking place there is illegal.
So, believe it or not, it’s not illegal to access the Dark Web; there are actually reputable brands and companies who have sites accessible via the Dark Web. It can simply be a dangerous proposition to peruse the Dark Web and engage with whoever you may meet, especially if it means revealing any personal data.
The Dark Web is used by cybercriminals to buy and sell illegal goods and services, coordinate attacks, distribute malware and phishing kits, and share other prebuilt exploits. But, perhaps a big surprise to anyone thinking the Dark Web is just for criminal activity, it can also be leveraged for legitimate purposes. Let's now take a look at both use cases.
There are many authoritarian governments across the globe, and people living under such regimes often need to anonymously communicate. In fact, 在这种情况下，人们通过虚拟专用网(VPN)使用暗网通常会安全得多。.
Many governmental organizations, several newspapers, and myriad tech organizations have a presence on the Tor network, which keeps their identities anonymous when interacting with the Dark Web. 这样做的原因可能是为了显示对隐私的承诺，或者允许人们匿名传递信息. 《pg电子》在Tor上有一个SecureDrop设施，CIA也有，它可以让任何想要秘密传递信息的人虚拟进入.
Accessing and using Dark Web protocols such as Tor is not illegal; it's just been adopted as the platform of choice by many bad actors who undertake illegal activities.
为那些出于合法原因希望匿名的人提供的保护，也为那些在现实世界中渴望私人通信的网络罪犯和罪犯提供了同样的匿名性. While the amount of traffic is small compared to the e-commerce taking place on the open web, there is no denying that the Dark Web is a haven for bad actors and illegal e-commerce activities.
暗网黑市上交易的非法内容和暗网上的非法活动分布在广泛的活动范围内，执法机构和互联网服务提供商(isp)花费大量时间试图打击这些活动. Nefarious-use examples include:
这些非法活动中有许多使用比特币和其他加密货币进行交易，以便卖家和买家保持匿名. This makes it difficult for law enforcement agencies like the FBI, CIA, and international partner organizations to disrupt illicit activities. It is not impossible, however, as evidenced by the tracking and disruptions of Dark Web networks such as the Silk Road.
Some additional examples of materials for sale on the Dark Web could include:
深网和暗网之间的区别并不一定在于两者上存在的信息的“可寻性”, 因为这两种类型的在线信息库的特点是数据没有被谷歌或必应等搜索引擎索引. The main difference can be described by the following two aspects:
These differences aren’t necessarily clear-cut, as there are overlapping aspects between the Deep and Dark Web. 与表面网络(也被称为开放网络)相反，任何人只要有互联网连接就可以访问世界各地面向公众的网站, the Deep and Dark Web are attempting to house information that doesn’t necessarily want to be found. Therefore, it’s likely that not all deep- and dark-web file repositories represent good intentions.
As stated earlier, neither of these connected content repository networks are illegal to access. Indeed, 网络安全组织在进行威胁搜索或保护其网络或其客户的网络时，必须经常访问它们.
For instance, if a threat actor is in possession of stolen data from a large healthcare provider, 代表公司的安全人员可能会在整个暗网上进行大部分调查. Threat intelligence gathered from the Deep and Dark Web is likely to help future threat hunting teams when analyzing telemetry from beyond their own networks, such as the Deep and Dark Web.
These days, 保护有价值的资产和数据免受威胁行为者的侵害似乎越来越困难. 对于在医疗保健等关键领域处理敏感数据的企业组织尤其如此, energy, and finance. That’s why it’s more critical than ever to go on the offensive.
Cybercriminals lurk in the dark web to methodically coordinate their attacks, sell illicit goods, distribute malware and phishing kits, and share other prebuilt exploits. 深入敌后，在最早的阶段识别威胁行为者和他们的意图，这样你就可以适当地准备你的防御.
With proper monitoring resources, you can gain visibility into threat actors and their activities. 这包括访问受限制的通道和自动化情报收集，以预测针对您的组织的攻击, employees, and customers.
Monitor exclusive dark web forums and the private channels of threat actors. In this way, you’ll uncover new cybercriminal tactics and tools used to automate attacks, test for weaknesses, and scam your employees and customers. It’s important to step into their shoes to understand how perpetrators can and will attack you.
It’s critical to use a Dark Web monitoring solution that can keep a continuous eye on your adversaries and engage with threat actors. From these activities, the solution should be able to gather data samples, uncover motives, and help you deploy smarter cybersecurity workflows.