Voiceover: Smith has left the target's office and has returned to their base of operations, but their work isn't done. They open the app that allows them to track the information sent from the keylogger. It turns out that the business has just started the process of moving their employee portal into the cloud. Using the information they've gathered over the day, Smith logs into the cloud-based employee portal and gets to work, harvesting all the company employee data. There are almost endless opportunities to use this data, and it could make Smith a tidy profit on the dark web.

Mark: So, a hacker has got-, has already got access to the company systems, he's got malicious software on there, which will help him to get access to the company records. We call these the crown jewels, which is their personally identifiable information, which is worth quite a lot of money on the deep and dark web itself. Now, because they're moving to cloud, they're moving most of their devices to the cloud, they can further exploit the-, this moving because there's a-, there's a state of flux going on and that could be a very easy way to extract the information because they're going through that period of transition into the network. Now, he could also further exploit that by installing other types of software onto it to affect mobile devices. Maybe, like, using a tool called Mobistealth, which will give remote access to mobile devices themselves and that obviously will give access to the data itself, which you could exploit. I've come across situations like this where someone had compromised a website on the dark web and they were offering access to this, this company, which was a legal company, it hadn't been-, so they had access into the company itself and all they need is someone to exploit it, just for a sum of money, about $2,500. And that's how easy it is to do that type of activity, so that's what's happened on this occasion.

So, this is where we would have to have a layered approach. Defence and depth is the term we would like to use. Defence and depth and breadth, the breadth being the physical security, defence and depth is the layers of security we can use. One of those could be a firewall, which would prevent things going in and out of the network. The second could be antivirus software, to hopefully try to detect type of abnormal activity on the network. We could use an intrusion detection system, which detects activity and an intrusion prevention system which would detect and then prevent it from moving, and then data loss prevention to stop any type of assets from leaving the company to help prevent that type of activity going on. And these are the type of things they could have put in place to prevent it.

Virtualisation and cloud computing [ISME]