Story image

Four steps organisations can take to protect against encrypted tunnel attacks

05 Feb 18

Last December, employees of the several Australian government agencies had their data exposed in a massive leak. In addition to government employees, more than 40,000 workers in the private sector were impacted by the breach. The exposed data included passwords, phone numbers, credit card information, corporate content and more.

In the aftermath of breaches on this scale, many industry experts wonder how large amounts of data can be exfiltrated without organisations noticing. Ultimately, the massive exfiltration of data is a critical symptom of weak machine identity protection.

Machine identities are used to authenticate encrypted communication between machines. The cryptographic keys and digital certificates that comprise machine identities are one of the least understood and poorly protected parts of enterprise security infrastructures.

Today, organisations spend over $8 billion protecting usernames and passwords, but they spend a fraction of that amount protecting machine identities.

Cyber criminals are taking advantage of weak machine identity security by compromising it so they can hide in encrypted traffic. Nefarious actors can use encrypted tunnels to pivot across corporate networks, eavesdrop on confidential communications, route traffic to phishing websites and gain access to sensitive corporate data.

Unfortunately, this issue has only become more problematic, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection. 

In spite of these problems many organisations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don’t know how much of their encrypted traffic is decrypted and inspected.

These results are also consistent with what Australian security professionals tell us: they are not inspecting all their encrypted
traffic.

While some systems allow for the inspection of internal traffic, externally generated traffic is typically ignored. As a result, cyber attackers can take advantage of these blind spots because organisations are only focused on a portion of their encrypted assets. This can lead to large scale data exfiltration events.

This is a pressing issue, but with proper oversight organisations can reduce their risks. We suggest businesses follow the following steps to protect their machine identities from encrypted tunnel threats:

Identify your keys and certificates

Many security systems now perform high speed SSL/TLS decryption. But these systems cannot decrypt traffic if they don’t have access to your keys and certificates. If you don’t have an accurate, continuously updated list of all keys and certificates, you won’t be able to inspect your SSL/TLS traffic for malicious content.

Securely distribute your keys and certificates

The scope and size of distributing keys and certificates is daunting. It's so daunting that you may be tempted to delay the deployment of decryption systems. If not handled properly, even the process of collecting and distributing keys can introduce new security and compliance risks.

Keep your keys and certificates up to date

It’s important that you keep decryption systems up to date as certificates expire or are renewed or replaced. If your certificates are outdated, the amount of decrypted traffic you’ll see is decreased, which means blind spots and security risks are likely increasing.

Automate your key and certificate security

For most organisations, having continuous visibility of all their machine identities was considered virtually impossible, as it was seen as a manual, labour-intensive process.

To keep the process airtight, organisations should utilise tools that can easily integrate with leading systems for SSL decryption, next-generation firewalls, intrusion prevention, unified threat management, secure gateways, data loss prevention, anti-malware and more.

Ultimately, encryption can simultaneously be your best friend and your worst enemy. On the positive side, encryption offers organisations a high level of assurance and risk mitigation. However, if your machine identities are vulnerable to compromises or unexpected expirations, cyber criminals can easily take advantage of your encrypted assets.

After all, the most dangerous enemies are always the ones you can’t see.

Article by Venafi APAC regional director Terrie Anderson.

Keen to learn more about why you shouldn't blindly trust encryption tunnels? Click here for details.

Survey reveals CX disconnect is risky business
Too much conversation and too little action could lead companies to neglect, lose, and repel their very lifeblood, according to Dimension Data.
Should AI technology determine the necessity for cyber attack responses?
Fujitsu has developed an AI that supposedly automatically determines whether action needs to be taken in response to a cyber attack.
Police making progress into Cryptopia breach
New Zealand Police say they are making ‘good progress’ into the investigation of an alleged cryptocurrency theft from Christchurch-based crypto exchange Cryptopia.
NEC concludes wireless transport SDN proof of concept
"Operation and management of 5G networks are very complicated and require automation and closed-loop control with timely data refinement and quick action."
Trend Micro’s telecom security solution certified as VMware-ready
Certification by VMware allows communications service providers who prefer or have already adopted VMware vCloud NFV to add network security services from Trend Micro.
Top cybersecurity threats of 2019 – Carbon Black
Carbon Black chief cybersecurity officer Tom Kellermann combines his thoughts with those of Carbon Black's threat analysts and security strategists.
Avaya introduces private cloud delivery of its UCaaS solution
Avaya is supposedly taking a flexible hybrid approach to the cloud with these new solutions.
Data growth the growing case for managed colocation
The relentless growth of data could see colocation take on a new importance, says Jon Lucas.