“The surface, deep, and dark web have long been described as distinct segments comprising the internet. As a result, analysts achieve more valuable context and can react faster to threats to their organization or client. The Platform’s pivoting features also enable users to transition faster between web spaces and easily extract insights where risks intersect. Rather than using an iceberg to conceptualize threat intelligence sources, the internet’s evolution points more towards an interlaced mesh where online spaces constantly move and intertwine with each other.įlashpoint has integrated this approach into its solutions, which combine billions of posts daily from a range of social media, deep, and dark web sources in a single platform and an API. This allows intelligence experts to more effectively analyze threat data intersections and multidirectional breadcrumbs. However, tools that combine a broader range of surface, deep, and dark web feeds help desegregate online spaces and allow for more seamless web pivoting. There’s nothing inherently wrong with requiring multiple tools for effective digital risk strategies (in fact, using multiple tools is a best practice). Analysts can also overlook critical insights that are only gleaned when feeds are effectively cross-referenced. This siloed approach can result in a more cumbersome strategy as users bounce between tools.
#DEEP WEB ICEBERG DIAGRAM TEMPLATE SOFTWARE#
Conceptual models and threat intelligence strategies should focus on the intersection of different web spaces and reflect how they are actually used-but a segmented understanding of the internet often still informs digital risk strategies and threat intelligence software design.įor example, many threat intelligence products are highly specialized, focusing only on delivering social media, dark web, or technical feeds to users-sometimes even lumping deep and dark web feeds into the same category. The analogy no longer describes how the surface, deep, and dark web actually function and how risks unfold across these spaces. Whether or not we want to admit it, the internet iceberg’s notoriety affects how intelligence and security teams view the internet-and likely how they approach online investigations. Users responsible for disinformation campaigns and extremist propaganda also rely on the surface web and social media channels to access a wider audience than is available on the dark web. The ILPT (“illegal life pro-tips”) subReddit often hosts brand-targeted conversations relevant to corporate security teams. Yes, there is a LOT of valuable threat intelligence on the dark web-but digital risks and crime, from child pornography to terrorist networks, malicious hacking how-to’s, and stolen data, are also present on the deep and surface web.įor example, indexed public social media posts often contain criminal discussions. In reality, the surface web is significantly larger than the dark web in terms of site traffic, overall size, and in many instances, available threat data. The dark web does not have a “monopoly” on online threats-but this role has been exaggerated in part by iceberg-like depictions of vast scary blobs lurking beneath the surface. Online risks never occur in silos as the iceberg might suggest, and investigations that begin on the surface web often cross over to the deep and dark web, and vice versa. Many threat actors on the dark web have digital footprints that overlap deep and surface web spaces. Nefarious online activity happens on the surface and deep web as much as the dark web. In reality, they are not distinctly separated but highly interwoven, with deep and dark web pages “hiding in plain sight” amongst the navigable surface web.īeyond how the web is actually structured, the iceberg also fails to capture how users navigate the internet, especially from a threat intelligence perspective. It’s easy to think of the surface, deep, and dark web operating in compartmentalized “layers” of digital space. Where does the internet iceberg fall short, and what model is better suited to threat intelligence practices and solutions? Where the internet iceberg analogy gets it wrong However, the iceberg is no longer an accurate representation of how web spaces interact-yet it impacts how security professionals view the internet and consequently, how they approach digital risk protection strategies and tools. This image makes it easy to understand where content is accessible (or not) online, and represents how more anonymized and hidden parts of the web are valuable for investigating illicit activity and digital risk indicators like leaked data. Whitepaper: How OSINT tools can address current intelligence challenges.
0 kommentar(er)
