26 August 20265 minute readLANTEK Computers
Dark web monitoring is one of the most useful controls a small business can
turn on and one of the most oversold. It is worth being precise about both
halves of that.
What it is
It is a continuous search of the marketplaces, forums and data dumps where
stolen and leaked information is traded, looking for your company domain, your
staff email addresses, the passwords attached to them, and customer records
belonging to you. When something matching your business appears, you are alerted
with the detail of what was found and where.
What it typically finds
For a South African business of twenty to fifty people, a first scan usually
returns several staff email addresses with associated passwords, from historical
breaches at other organisations. At least one of those passwords is usually
still in use somewhere.
It also commonly finds addresses belonging to people who left years ago, on
accounts nobody ever disabled. In practice that second finding is often the more
serious of the two, because a dormant account with a valid password and no owner
is exactly what an attacker wants and exactly what nobody is watching.
Why a leak somewhere else is your problem
Because people reuse passwords. Somebody signed up to a supplier portal, a
conference registration or a shopping site with their work address and a password
they also use at work. That other organisation was breached. The credential is
now traded.
An attacker who buys it will try it against your Microsoft 365 tenant, your
remote access and your banking portal. Industry reporting consistently finds
that a large share of successful intrusions involve an attacker simply signing in
with a valid password rather than breaking anything at all.
What it cannot do
It cannot remove your data from anywhere. Once information has been traded it
is permanently out, and any provider offering to delete it is misrepresenting
what is possible. Treat that as a disqualifying answer.
It also does not scan or protect your systems. It looks outward, not inward.
It is an early warning that specific credentials are compromised, which buys you
the chance to change them before somebody uses them. That is the whole of the
value, and it is considerable, but it is not a security control in the way a
firewall or endpoint detection is.
What to do when something is found
Change the affected password immediately, everywhere that person has used it,
not only on the system named in the alert. Confirm multi-factor authentication is
enforced on that account. Check it for sign-ins you do not recognise. Then
disable any account belonging to somebody who has left.
The order matters. Changing one password on one system while the same
credential still works on three others is the most common way this goes wrong.
Where to start
Continuous monitoring of credentials, domains and email addresses is part of
every LANTEK service plan rather than an optional extra, because it is one of the
cheapest early warnings available.
If you want to see what is already out there first, the
free health check begins with a
one-off scan. It needs only your domain name, nothing is installed, and you keep
the report whether you work with LANTEK or not.