Name: Why can't law enforcement just close the dark web for good?
Start: 2024-12-13T15:00:00Z
End: 2024-12-13T15:00:11.000Z
Location: BrightTALK
Rating: 5

Searchlight Cyber provides organizations with relevant and actionable threat intelligence, to help them identify and prevent criminal activity. Originally founded in 2017 with a mission to stop criminals acting with impunity on the dark web, we have been involved in some of the world’s largest dark web investigations and have the most comprehensive dataset based on proprietary techniques and ground-breaking academic research. The company has expanded and evolved, adding external threat management capabilities to create a Continuous Threat Exposure Management platform for organizations. Today we help government and law enforcement, enterprises, and managed security services providers around the world to identify threats and prevent attacks. 

About Assetnote
Founded in 2018, Assetnote was born from the collective expertise of some of the leading minds in offensive security, and has grown to reflect the values and ability of our brain trust. Pioneering the Attack Surface Management category, Assetnote’s Continuous Exposure Management platform closes the gap between the attacker’s and defender’s perspectives with industry-leading real-time awareness of your evolving attack surface and the exploitable security exposure identified within. Monitoring millions of assets every hour for our customers, we are proud to be the chosen security platform for a wide array of organizations, from innovative startups to members of the Fortune 500, FTSE 100, and ASX 200. To find out more visit assetnote.io.

In this episode, we explore the blind spots in IP-centric asset discovery and why organizations need a complete view of their attack surface. Modern cloud architectures, load balancers, and web application firewalls (WAFs) can obscure critical assets, making reconnaissance efforts more challenging.

We break down how these hidden risks emerge and why traditional scanning methods often fall short. We also examine the value of subdomain data and passive DNS in exposing overlooked attack surfaces. Topics include:

- Why Internet-wide scanning has critical limitations
- How a broad and deep approach improves attack surface mapping
- Real-world examples of security blind spots in modern infrastructure
- The impact of DNS and path-based routing on security assessments
- The role of IPv6 in asset discovery

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E07 Internet-wide recon: Moving past IP-centric approaches

Let’s take a closer look at shadow exposure and its connection to third-party software - an often-overlooked aspect of shadow IT. Michael and Shubs, co-founders of Assetnote (a Searchlight Cyber company), explore the history of shadow IT, how it has evolved, and the hidden risks of widely used enterprise software that organizations may not fully grasp. Join us as we discuss: 

- The origins and implications of shadow IT
- The challenges of visibility and transparency with third-party vendors
- Real-world examples of vulnerabilities in critical software, including ServiceNow and IBM's ASPR Fastback
- The limitations of security questionnaires and self-attestation processes
- The importance of proactive security measures and effective disclosure processes

We also share insights from our security research team and discuss how organizations can better manage their attack surfaces to mitigate risks associated with shadow exposure. 

Learn more about Assetnote at https://www.slcyber.io/asm

S01 E06 Beyond shadow IT: Understanding the true attack surface of your software

Today, we explore the world of asset discovery and reconnaissance, particularly how these practices have evolved. Historically, discussions around reconnaissance have been overly simplistic and tool-centric, often focusing solely on the latest tools rather than the underlying principles and methodologies. 

Join Assetnote’s co-founders,  as they break down their approach to reconnaissance into five key elements: breadth, depth, context, amplification, and focus. They discuss the importance of understanding the attack surface holistically and how to effectively map it out in a modern context. Learn why breadth is crucial for discovering all assets related to an organization, how depth allows for a deeper understanding of those assets, and the significance of context in enhancing your reconnaissance efforts. They also touch on amplification techniques that can help you uncover hidden vulnerabilities and the importance of applying an offensive mindset to your reconnaissance work. 

Whether you're a seasoned security professional or just starting in the field, this episode offers valuable insights and practical advice to enhance your reconnaissance skills and improve your overall security posture. Discover how to think beyond tools and embrace a more strategic approach to asset discovery!

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E05 The art of recon: Strategies for modern asset discovery

In this episode of Surfacing Security, a series on Attack Surface Management (ASM) brought to you by Assetnote (a Searchlight Cyber company), we dive into the technical complexities of DNS resolution in ASM asset discovery.

Join us as we break down the challenges, implications, and solutions we’ve encountered while handling DNS resolution at scale. From DNS wildcards to security scanning considerations, we explore how DNS data plays a crucial role in comprehensive reconnaissance.

Your hosts, Michael and Shubs, co-founders of Assetnote, share their experiences refining DNS resolution for asset discovery. They discuss the impact of DNS records on security scanning, including detecting misconfigurations and security risks. Plus, hear about a fascinating case of large-scale DNS poisoning, how it was detected, and how attackers exploited it.

We also compare IP-centric tools to a subdomain-centric approach, showing why DNS data is essential for complete attack surface mapping.

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E04 The unknown complexities of DNS resolution

There's a lot of confusion in the ASM (Attack Surface Management) market. In this episode, we discuss the core principles of ASM, the challenges of building and maintaining an effective ASM system, and the importance of safety and accuracy in external attack surface scanning. We share insights on the differences between asset discovery and exposure management, the pitfalls of relying on off-the-shelf tools for ASM, and the critical role of curated checks in ensuring the quality and safety of scanning results. 

We go behind the scenes regarding the work that goes into creating a reliable ASM system, the impact of open-source tools on the market, and the value of a well-designed and integrated approach to attack surface management. 

Gain a deeper understanding of the complexities and considerations involved in building and maintaining an effective ASM system, and learn why quality and safety are paramount in safeguarding your organization's external attack surface.

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E03 Confusion in the ASM market

Join Assetnote’s co-founders as they break down the core principles of Attack Surface Management (ASM), the importance of understanding real exposure across your attack surface, and how security research uncovers vulnerabilities beyond known CVEs.

This webinar is part of Surfacing Security, a series on ASM brought to you by Assetnote, a Searchlight Cyber company. Discover how Assetnote’s team has pioneered a new approach to security research - finding hidden exposures and delivering actionable insights for customers. Tune in for a deep dive into ASM fundamentals and the critical role of proactive mitigation in strengthening security. 

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E02 What is "True" Attack Surface Management (ASM)?

In this episode of Surfacing Security, a series on ASM brought to you by Assetnote (a Searchlight Cyber company), Michael and Shubs explore the background and evolution of Assetnote, a pioneering Attack Surface Management platform. 

They discuss the company’s early challenges, the strategic decisions that shaped its success, and the critical role of speed, scale, and automation. Plus, they share their unique approach to security research and building a market-leading ASM solution that reduces the risk of blind spots and undetected vulnerabilities that could be entry points for would-be attackers.

Learn more about Assetnote at https://www.slcyber.io/asm.

S01 E01 The untold story of Assetnote: Origins and evolution

In this session, we're joined by Michael Gianarakis and Shubham Shah, the co-founders of Assetnote, where we'll break down the flaws in traditional ASM and explore how teams can take a more proactive approach that actually helps security teams reduce risk. Topics we'll cover include:

- The risks of 'shadow exposure' (the hidden attack surface) where threats are introduced by third-party tools like ServiceNow, Citrix, and Slack
- Why IP-based scanning is not enough when managing modern cloud and CDN environments
- The importance of proactively closing the time gap between exposure detection and mitigation 

We'll explore why the traditional concept of network perimeter security is no longer enough to defend against today’s evolving cyber threats. As organizations rapidly adopt cloud tools and shadow architecture, their true attack surface expands exponentially – exposing them to phishing, leaked credentials, and the persistent risk of ransomware attacks.

If you’ve ever watched a sci-fi film, you’ll know that no matter how impenetrable an opposition’s defences may seem - there is always a chink in the armor that can be exploited - an opening that can be exploited. Whether it’s the Death Star in Star Wars, the City Destroyer in Independence Day, or The Borg Cube from Star Trek, attackers always find a way in. Similarly, in the world of cybersecurity, today’s perimeter defenses are no longer enough to keep intruders at bay.

Register today for your chance to hear from two of the most preeminent minds in Attack Surface Management as they answer:

- What are the top threats companies should be monitoring to bolster their ASM programs
- How to align this with your security objectives, risk tolerance, and business goals
- What strategies and practical steps should security teams take to strengthen their cybersecurity posture

What is true Attack Surface Management (ASM)? Legacy vs modern ASM

Join Searchlight Cyber as we explore partnership opportunities for MSSPs and VARs looking to stay ahead in dark web intelligence and Continuous Threat Exposure Management (CTEM). Learn how we can work together to meet growing customer demands and drive business growth.

- Be the first to know when cybercriminals are targeting your customers
- Enhance your offering and meet the demand for dark web intelligence
- Increase your margins with dark web intelligence

“Preventive cybersecurity will become increasingly important for businesses in the coming years and the addition of the pre-attack intelligence provided by Searchlight Cyber complements the growth of the more conventional protection market, such as SOC and EDR. ”

Julien Lopizzo, CEO and founder of Semkel

Discover the benefits of Searchlight Cyber's Partner Program

Cybercrime is a growing trillion-dollar industry, driven by the recent proliferation of infostealers and the increasing accessibility of AI tools. Despite years of countermeasures, threats continue to outpace defenses, leaving organizations vulnerable to attacks. In this webinar, Caleb Barlow, CEO of Cyberbit and former IBM X-Force leader, dives into the roots of cybercrime and draws insights from his 2016 TED talk, which has been viewed over 1.7 million times, to explain what has changed in the past decade (and what hasn’t). Join us to learn:

- Why cybercrime remains so profitable
- The rise of infostealers and their off-the-shelf availability
- How to make your organization a harder target for criminals
- The critical role of threat intelligence sharing in disrupting attacks

With crime increasingly shifting to the dark web, Caleb will also give insights on why security teams need access to this intelligence source and how without reliable access to this critical data, you have a massive blind spot in your operations - leaving you blind to criminality being planned on the dark web - including ransomware attacks, targeting of your VIPs and executives, and the trafficking of illicit goods and sensitive information.

Where is cybercrime coming from in 2025?

It’s time for the bi-annual state of ransomware on the dark web report. In this webinar, you’ll find out which groups are most prolific, the emerging groups to watch, and the tactics lookout for in 2025.

In this webinar, we’ll be joined by cybersecurity experts, including Searchlight Cyber’s Head of Threat Intelligence, Luke Donovan, for a statistical analysis and profiles on the groups who claimed the most victims in 2024 and look likely to remain active in 2025. Additionally, our experts will share a review of the impact law enforcement had on disrupting major groups and how this might change how ransomware gangs and cybercriminals conduct their operations this year. 

Register today for unique insights into:
- Profiles on the most prolific ransomware groups in 2024
- A look ahead to the groups to monitor and investigate in 2025
- See how security professionals can build profiles on ransomware groups

We’ll also cover the most common ransomware questions you’ve asked, ensuring we address your specific concerns. Register for the webinar and submit your questions to be answered live.

The Ransomware Report 2025: Dark Web Trends, Groups & Insights

The same threats posed by the dark web to businesses and individual create opportunities for cybersecurity and investigation teams. In this final episode in the series, we invite CEO and Co-Founder, Ben Jones back to talk about why he founded Searchlight Cyber and explain how monitoring the dark web for attributes linked to your external threat surface, such as domains, IP addresses, and employee credentials, can help you spot the earliest signs of criminals targeting your business and resolve risks before they turn into costly incidents.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How can businesses protect themselves from dark web threats?

What are the challenges with crawling and scraping data from the dark web to capture sensitive information, such as the auctioning of vulnerabilities or employees advertising insider access on forums - ideally before threat actors erase the evidence? We speak with Head of Product at Searchlight Cyber, Dave Osler and Lead Data Engineer, David Andreas, to understand the pros and cons of the different approaches security and investigation teams can leverage to defend themselves against threats on the dark web.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How does Searchlight gather data from the dark web?

Are dark web purchases guaranteed? How anonymous are cryptocurrency transactions in these shadowy corners of the internet? And how do criminals turn digital coins into spendable cash? (after all, you can’t buy a sports car with crypto – yet.) To tackle these questions, we’ve invited back Searchlight Cyber’s Head of Threat Intelligence to break down the dark web’s underground economy.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What role does cryptocurrency play on the dark web?

There’s ‘no honour among thieves’, so how do cybercriminals monetize their illicit activities while evading detection from law enforcement on the dark web? Joe Honey, Threat Intelligence Engineer at Searchlight Cyber joins us to explain how hackers use the dark web, master their ‘craft’, and how security teams, can investigate and defend against the attacks from these threat actors.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

How do hackers use the dark web?

The dark web is home to many such digital black markets that operate largely in the same way to e-commerce sites we use everyday. However, unlike these familiare sites, the dark web is far more volatile, with new markets closing and opening all the time. In this webinar, Luke Donovan, Head of Threat Intelligence at Searchlight Cyber, guides us through some of the autoshops and escrow marketplaces you should be monitoring.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

Where are items bought and sold on the dark web?

Despite its recent rise in popularity, I2P has existed as long as Tor. In this webinar, Dr. Gareth Owenson, CTO and Co-Founder of Searchlight Cyber, breaks down the differences between I2P, Tor, Lokinet, Zeronet, and the multiverse of anonymity networks that exist – and shares why certain darknets rise to prominence while others remain in the shadows.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

What’s the difference between I2P and Tor? Are there other dark webs?

Who uses the dark web and why - are there any positive uses of the dark web?

How do ransomware groups operate on the dark web?

What are the risks if your business’s information ends up on the dark web?

How does the dark web work?

What is the dark web (and why should cybersecurity professionals care about it)?

The 12 Days of Dark Web FAQ

Given that the dark web is primarily used to facilitate illicit activities (according to research, 65% of searches on the dark web are for explicitly illegal content), you might wonder why can't we simply shut it down? While this may seem like a straightforward solution to tackle the rampant sales of illegal goods, data, and organized crime, the answer isn’t so simple. Over to Dr. Gareth Owenson, Co-Founder and CTO of Searchlight Cyber, to explain more.

This video is part of the '12 Days of Dark Web FAQ' webinar series. Find all previous episodes here: https://series.brighttalk.com/series/7011?utm_source=SearchlightCyberUK&utm_medium=BrightTALK&utm_campaign=7011

Why can't law enforcement just close the dark web for good?

Dark Web

Cyber Crime

Cyber Security

Cyber Skills

Cyber Attacks

Investigations

Cyber Incident Response

Threat Hunting

Cyber Intelligence

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The unexpected nature of natural disasters and other disruptive events means that preparation is key to managing disaster recovery and business continuity planning. Join the business continuity and disaster recovery community for live and recorded presentations discussing best practices for business continuity planning, disaster recovery programs and business continuity management. Learn from BCDR experts to develop your critical infrastructure and gain insight into tactical solutions to your BCDR issues.

Business Continuity / Disaster Recovery

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

Finance

Leadership styles are continually evolving to incorporate new ways of thinking about employee satisfaction, motivation and performance. Find webinars and videos on the strategies, techniques and qualities that make an effective leader. By participating in this community you will gain insight into current leadership theories and how to optimize employee performance.

Leadership

In the business management community, commercial experts will be sharing webinars and videos on an array of subjects. From sales and marketing, to finance, productivity and growth, this content will help you stay up-to-date with the current economic environment and provide timely management insight to drive business growth.

Why can't law enforcement just close the dark web for good?

Presented by

About this talk

More from this channel