Terbium Labs offers insights into how your organization should rethink data security as more information is exposed, and re-exposed, every day

1. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
© 2019 Terbium Labs
What’s Your Organization’s Data
Exposure on the Dark Web?
Understanding Business Risk from Data Exposure Online

2. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
2
About Us
Dee Liebenstein, VP of Product
Emily Wilson, VP of Research

3. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
What is the dark web?

4. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
4
The dark web has a bad reputation: clickbait headlines and popular
media are full of inaccuracies.
The dark web is home to both illicit and legal activity, and using the dark
web is not inherently sketchy.
The dark web is just another part of the internet. Criminal activity
takes place across the internet, not exclusively on the dark web.
Myths and Misconceptions

5. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
5
Three segments of the internet
The open web is
accessible through
search engines and
requires no special
technology to access.
The deep web is not
accessible through
search engines, but
generally requires no
special technology to
access.
The dark web is not
accessible through
search engines and
generally requires
special technology to
access.

6. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
6
ON-DEMAND WEBINAR
Visit terbiumlabs.com to access the
on-demand webinar, What’s Your
Organization’s Data Exposure on
the Dark Web?

7. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
The dark web is designed
for privacy and
anonymity. The desire for
privacy does not equate
to criminality.

8. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
What’s on the dark
web?

9. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
9
What is the dark web?
The dark web hosts an illicit ecosystem, made up of
multiple criminal economies.
The fraud economy is one of the most resilient
communities in the illegal ecosystem, because it is based
on digital, interchangeable goods.
The fraud economy has expanded beyond dark web
criminal markets into deep web markets, social media
platforms, and open web sites.

10. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
The online fraud economy
includes all of the raw
materials, resources, and
services a cyber criminal
needs

11. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
11
What type of data gets traded in the fraud
economy?
• Personal information
• Financial information
• Corporate Data
• Guides and Tutorials
• Services

12. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
12
• Names and addresses
• Contact details
• Credentials
• Government identifiers
• Extended personal history
Personal Information
Phishing
Account takeover
Identity theft
Physical security threats

13. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
13
• Payment Cards
• Bank Accounts
• Payment Processor Accounts
Financial Information
Unauthorized charges
Money laundering
Account takeover
Identity theft

14. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
14
• Employment-associated PII
– Corporate email addresses
– Corporate credentials
• W2s and tax information
• Invoicing and vendor/contractor details
• Intellectual property
Corporate Data
Tax fraud
Identity theft
Account takeover
Phishing
Business email compromise
Misuse of proprietary information

15. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
Case Studies of
Corporate Data
Exposure

16. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
16
Case Study:
Terbium Labs detected a fraudulent
customer support account for a popular
retailer on Twitter. This account
attempted to intercept legitimate
customer support by responding to
tweets.
The account requested users direct
message their account details for further
support, at which point the cyber
criminals would exploit the shared
credentials.
Brand Misuse Monitoring
How to Protect:
A comprehensive digital risk protection
strategy goes beyond purely monitoring
for data leaks.
By monitoring for the appearance of
corporate information – including
corporate branding – across social
media and open web accounts,
organizations can detect and take down
fraudulent efforts to steal customer data
and generate reputational damage.

17. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
17
Case Study:
Terbium Labs detected an extensive leak
of high-profile customer information
belonging to a Matchlight client.
Analysis on the data leak indicated the
client list was not the result of a direct
leak of client information, but instead the
result of a third party data incident.
Data Loss Detection
How to Protect:
Organizations face fallout from data
exposure regardless of the source of the
leak. Monitoring for customer records,
including specific customer contact
details, provides immediate visibility into
exposure.
Matchlight’s fully private monitoring
allows for comprehensive visibility
without increased risk.

18. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
18
Case Study:
Terbium Labs detected a series of fraud
guides for sale for a financial institution.
These guides included updated
instructions on how to bypass multi-
factor authentication on customer
accounts to execute account takeover
exploits against the financial institution.
Fraud Detection
How to Protect:
Monitoring for corporate brands,
products, and other unique indicators
combined with analyst activity to identify
and purchase fraud guides.
Investigating detailed fraud techniques
contained in guides and tutorials allows
for in-house remediation and further
identification of potentially compromised
accounts based on outlined techniques.

19. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
Choosing a Digital Risk
Protection Provider

20. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
A comprehensive digital
risk protection strategy
provides full and ongoing
visibility into your
corporate exposure online
– without sacrificing data
privacy.

21. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
21
Three key requirements for a provider
Digital risk protection providers are not created equal. In order to ensure
your organization adopts a comprehensive strategy, look for a provider
that prioritizes:
• Privacy
• Breadth of Coverage
• Actionable Insights

22. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
22
Privacy
Data Fingerprinting allows Matchlight to search the web for matching data without
knowing what that data is
Securely generate irreversible fingerprints on your corporate network without revealing
any information about the original documents to us or any third party

23. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
23
Breadth of Coverage
• Customer PII Theft
• Employee PII Theft
• Fraud Guides
• Fraudulent Apps
• Customer Phishing
• Account Takeovers
• Automated and continuous
crawling across the open, deep
and dark web
• Intellectual Property Theft
• Patient PII Theft
• Imitation Accounts
• Impersonations
• Fake Domains
• Targeted Scams
Examples of Digital Risks

24. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
24
Actionable Insights
– What was found,
where and how
much
– Company’s overall
risk measure
– Top concerning
assets
– Dedicated Risk
Analysts
– Relevant contextual
information
– Actionable
Intelligence with
recommendations
– Comprehensive view
of risk
– Context to act
quickly
– Vetted
recommendations
– Prioritization
Automated
Analytics
Analyst Team Risk Analysis

25. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
25
New Research
The latest survey from Terbium Labs
unpacks how organizations think about
data exposure – and reveals a startling
disconnect amongst IT professionals in
how they measure risk and plan for digital
security incidents.
Visit terbiumlabs.com to access a full
copy of the report, The Underrated Risks
of Data Exposure.

26. © 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
© 2019 Terbium Labs. Confidential—Do not duplicate or distribute without written permission from Terbium Labs.
Digital Risk Protection
Actionable Insights
Fully Private Monitoring
sales@terbiumlabs.com
Learn more at terbiumlabs.com