Frequently Asked Questions

Sensitive information is information that should be protected from unauthorized access. It is called sensitive because its disclosure could be harmful. Examples of different types of sensitive information are: confidential messages, business secrets like internal source code, or governmental classified data. The disclosure of sensitive information can result in reputational damage, identity theft, regulatory fines and both civil and criminal penalties and state statutes.

Exposed credentials are usernames, passwords (and the combinations of these), tokens or other identifiers that enable access to restricted systems. Exposed credentials are the most popular route by which hackers gain access to a system through password reuse attacks. This information can come from breached systems or information leaks, the content of which might be made available for free or for sale. In many countries, the law requires organisations to notify individuals whose credentials have been breached.

Hacker groups such as Anonymous are loosely associated international networks of activists and ‘hacktivists’. They organise attack campaigns that begin with a published manifesto – a statement explaining the reason for the attack – followed by target lists and communications regarding how to perform the attack. When hacker groups target organisations, this indicates an intentional attempt to break into their systems or to perform ‘denial of service’ attacks that cause downtime for critical systems. Hackers also target individuals within the organization by using target lists of interesting people and user profiles. Whether attack groups are successful or not depends on the target organisation’s security posture and the participating hacktivists’ skills and tools.

In fact, all variables are beyond company control as they have happened already. What companies can do, however, is to understand what drives exposure and reduce it in the future. Typically companies invest into security by making new cyber security policies, training their staff and implementing new security technologies.

Information regarding mergers and acquisitions. Databases and registers. Business and project plans. Internal memos. Credentials. Personal credit card numbers. Most of the companies affected are unaware that they are have experienced data breach before the data is being sold and exploited.

Score: Extreme Exposure. Typically the organisation has already been breached at this level.
Risk: Compliance, reputation & operative
Recommendation: Conduct immediate asset discovery, vulnerability management and exposure assessment. Start incident reponse procedures and perform follow-ups. Immediately notify data protection and compliance officers and prepare for crisis communications.

Score: Very High Exposure. Typically the organisation has either been breached, or hacker groups are actively targeting it.
Risk: Compliance, reputation & operative
Recommendation: Conduct immediate asset discovery, vulnerability management and exposure assessment. Immediately notify data protection and compliance officers and prepare for crisis communications

Score: High Exposure. Typically the organisation has a large amount of exposed clients, accounts and data at this level.
Risk: Compliance & operative (emerging risks like phishing and targeted attacks)
Recommendation: Conduct immediate asset discovery, vulnerability management and exposure assessment. Notify data protection and compliance officers.

Score: Moderate Exposure. Typically the organisation has a moderate amount of exposed clients, accounts and data at this level.
Risk: Compliance & operative
Recommendation: Conduct exposure assessment to discover the exposure’s content and impact. Immediately notify data protection and compliance officers.

Score: Low Exposure. Typically the organisation has no automatically identified exposure risks. Some organisations usually discover exposure by using a wider range of search criteria.
Risk: Compliance
Recommendation: Conduct exposure assessment if there are unidentified events matching the given domain names. We advise monitoring the organisation’s cyber exposure as well as personal accounts. We do provide a free tool, Hacker for Business, for this purpose

Publicly available search engines such as Google only cover a limited portion of the Internet. This is the visible part that we call the surface web. Where the surface web ends, the deep web begins. This is everything you can potentially access with your browser that is not indexed by search engines. This could be your e-mail accounts, intranet, leak platforms, some discussion forums, private blogs and so forth. The dark web refers to a technology that makes surfing sessions more private – technically, ‘anonymous’. These technologies include TOR and I2P and other. In TOR, for example, there are seven layers of encryption before a data packet reaches the desired host. As a result, no-one will be able to identify who is surfing darkweb, where his traffic originates from, or where the servers are that the person is using.

The deep web, sometimes called the invisible web, is the large part of the Internet that is inaccessible to conventional search engines. Deep web content includes email messages, chat messages, private content on social media sites, electronic bank statements, electronic health records and other content that is accessible over the Internet but is not crawled and indexed by search engines.

CEI is an independent research project that compares three areas of exposure: disclosure of sensitive information, exposed credentials and hacker group targeting. CEI results are based on data collected by Cyber Intelligence House. CIH’s services go beyond this scope and they also include other areas of exposure such as internal data breaches, external data breaches, black market activity, financial information and personally identifiable information (PII).