Heartbleed ahead for enterprises?

Palo Alto Networks is warning that the full effects of the Heartbleed vulnerability may not yet have been felt, despite many believing Heartbleed is behind us.

And the company is warning that while the visible impact of Heartbleed has been on web applications such as Google, Dropbox, Facebook, Yahoo!, online banking and other vulnerable targets on the web – which have now been updated – it's enterprises which are now at risk.

Gavin Coulthard, Palo Alto Networks manager systems engineering Australia/New Zealand, says the web impact already seen was 'only the tip of the iceberg'.

“The Heartbleed vulnerability puts the tools that were once reserved for truly advanced cyber criminals into the hands of the average attacker, notably the ability to breach organisations and move laterally within them.”

A recent Palo Alto Networks Application Usage and Threat Report reveals that in Asia Pacific, 32% of applications are capable of using SSL. The top 10 sub-categories in the enterprise that can use SSL include file-sharing, instant messaging, social networking, photo-video, internet conferencing, remote access, internet-utility, management, email and general business.

“Most enterprises of even moderate size do not have a good handle on what services they are running internally using SSL encryption, much less those that the end-users have brought into the network,” says Coulthard. “More importantly, they don't inspect applications for malicious activity.

“SSL use is a much bigger problem that it was even a year ago, because if organisations don't know how many applications running on the network use SSL, they also don't know how many of those applications use OpenSSL, which may directly or indirectly expose the organisation,” he adds.

“Proofs-of-concept that take advantage of Heartbleed are no doubt in the works.

“It is only a matter of time before an automated internal scanner is developed that finds vulnerable services on the local network and exploits them with a single click. The challenges that presents to organisations is significant. For example, once you know how many internal applications may be using OpenSSL, how difficult will it be to update them? If it is a business-critical application, the effort is not small.”

Coulthard says organisations must determine which applications are capable of using SSL – both business applications and those in use by employees – then determine which of them use OpenSSL.

“The primary risk to end user-introduced applications using OpenSSL is the endpoint. The secondary risk is what is on that endpoint machine in terms of company data. Knowing which applications are using SSL, who is using them, and what network resources the person has access to will let organisations gauge and then minimise their exposure.”