Page 68 - Cyber Defense eMagazine Annual RSA Edition for 2024

Context Matters: Beyond Features to IP Addresses

While VPN features offer valuable insights, additional context is essential for evaluating potential risks
associated with IP addresses. IP addresses may circulate back into an ISP block or be shared by multiple
VPN providers within a hosting block. Understanding the recency of an IP address and its association
with a block is crucial to avoiding misjudgments and maintaining a nuanced approach to threat
intelligence.

Forensic analysis of IP addresses plays a pivotal role in addressing the growing frequency of cyber
threats like ransomware, account takeovers, DDoS attacks, and malware delivery. Access to high-quality,
up-to-date data tracking IP address movements geographically and between VPNs and hosting blocks
is vital for learning from past attacks and preventing future ones.

Proxy vs. VPN vs. Darknet: Navigating the Encryption Spectrum

A VPN, operating as an encrypted connection from a device to a network through a single IP address,
has evolved beyond its corporate roots. Commercial VPNs create tunnels for users to hide their original
locations, catering to both benign and malicious users. The encryption spectrum now includes major tech
offerings, commercial VPNs, and the darker realms of the darknet, each serving different purposes with
varying levels of oversight.

As we navigate the intricate tapestry of VPN evolution, one thing is clear – the role of VPNs in our digital
lives is both dynamic and indispensable. From the corridors of corporate networks to the far reaches of
the darknet, the evolution of VPNs reflects not just technological advancements but the ongoing battle
between privacy and security in our interconnected world.

About the Author

Jonathan Tomek, VP of Research and Development, Digital Envoy.
Jonathan is a seasoned threat intelligence researcher with a background of
network forensics, incident handling, malware analysis, and many other
technology skills. Jonathan served in the United States Marine Corps. He
worked at multiple threat intelligence companies including White Ops and
LookingGlass Cyber Solutions, where he built their threat capabilities to
include identifying tactics, techniques, procedures of malicious actors. He
led several technical cybercrime and espionage teams in their initiative to
enhance technical efficiency in malware analysis, malicious actor tracking, and tool development.

He is a co-founder of THOTCON, a world-renowned hacking and security conference hosted in Chicago.
As a researcher and leader, he has spoken at many security conferences around the world. He has won
or placed in multiple national hacking competitions including DEFCON CTF. Jonathan can be reached
online at ([email protected]) and at our company website https://www.digitalelement.com

68