“Dark web” which is not to be confused with “Deep web” is that part of the web which cannot be accessed by traditional search engines likes Google, Bing or Yahoo. In addition to this, it can only be accessed by special browsers like ‘Tor – the Onion router’ or ‘I2P'(Invisible Internet project). The “Tor router” enables anonymized browsing of the “dark web”.
“Dark web” domains end with “.onion” and are purposefully hidden from popular search engines. They are used to host a number of illegal activities.
Images source: Google images
Risk analysis is a tool to implement risk management. Before we go onto see the definition of risk analysis, recall that a vulnerability is “weakness” in the system and the “risk” is the threat agent exploiting the vulnerability.
Some examples of the three concepts working together are when a vulnerability like an unpatched application is exploited by a threat agent like a malicious user to create risk. This risk can only be reduced by applying the patch to the application.
Risk analysis is done by the following steps:
a. understanding the vulnerabilities within the organization
b. assessing the value of the assets in the organization
c. calculating the value of safeguards that have to be implemented
d. Is the value of safeguard greater than the value of asset? If so, look for cheaper safeguards but equally effective safeguards.
While risk can only be reduced/mitigated or transferred, it cannot be entirely avoided. It is always good to remember that there is no such thing as 100% security!
The top-down approach to security is when an information security program moves ahead with management approval. The appropriate security funding is secured and there is a proper plan and direction towards the program. This approach is more efficient and generates better results. In short, the top-down approach is a more active and serious approach to security.
In contrast, the bottom-up approach to security is a reactive approach to solving information security concerns. Only after there has been a data breach or several hacking incidents does the company decide to act. This approach will only generate “stop gap” results and not long term results.