Credentials fall into the wrong hands in many ways: through data leaks at online services, through malware on private devices, or through phishing. Such data is then often traded, published in forums, or merged into large collections. Leak monitoring searches specifically for entries that belong to a company, usually based on its email domains. The approach is also called dark web monitoring or credential monitoring.
The benefit lies in the head start: if you know that a password is circulating publicly, you can change it before it is used for an attack.
How does leak monitoring work?
A leak monitoring service continuously analyzes sources, including published data leaks, forums, darknet marketplaces, paste sites on the internet, and logs from infostealer malware. Hits for the monitored domains or terms are collected, deduplicated, and assessed. Context is important: does the entry come from an old, long-known leak, or is it new? Does it contain a plaintext password, only a hash, or merely the email address?
The service then reports which accounts are affected and which steps make sense.
Typical examples
- An employee's company email address appears with a password in the leak of an online shop where she had registered for work. If the same password was also used internally, there is an urgent need for action.
- Credentials for the company VPN are found in the logs of infostealer malware from a private computer.
- After a publicly known data leak at a service provider, it is checked whether the company's accounts are affected.
What companies should keep in mind
- Determine in advance who receives and assesses hits and which measures follow, such as password changes and reviewing sign-ins.
- Use multi-factor authentication and a password manager so that a leaked password alone is of little use.
- Inform affected people fairly: a hit is usually the result of someone else's leak and not a personal failure.
- Clarify data protection issues, since personal data is involved.
How it differs
Leak monitoring shows that data has already been exfiltrated and does not itself prevent an attack. It complements preventive measures such as technical protection mechanisms and security awareness but does not replace them.
How TOMORIS relates
At TOMORIS, the GRID building block GRID.darkwatch covers leak monitoring. The TOMORIS software DarkWatch for leak monitoring follows the principle: rules decide, AI formulates.
View GRID.darkwatch