sb-nz logo
Story image

Four steps organisations can take to protect against encrypted tunnel attacks

05 Feb 2018

Last December, employees of the several Australian government agencies had their data exposed in a massive leak. In addition to government employees, more than 40,000 workers in the private sector were impacted by the breach. The exposed data included passwords, phone numbers, credit card information, corporate content and more.

In the aftermath of breaches on this scale, many industry experts wonder how large amounts of data can be exfiltrated without organisations noticing. Ultimately, the massive exfiltration of data is a critical symptom of weak machine identity protection.

Machine identities are used to authenticate encrypted communication between machines. The cryptographic keys and digital certificates that comprise machine identities are one of the least understood and poorly protected parts of enterprise security infrastructures.

Today, organisations spend over $8 billion protecting usernames and passwords, but they spend a fraction of that amount protecting machine identities.

Cyber criminals are taking advantage of weak machine identity security by compromising it so they can hide in encrypted traffic. Nefarious actors can use encrypted tunnels to pivot across corporate networks, eavesdrop on confidential communications, route traffic to phishing websites and gain access to sensitive corporate data.

Unfortunately, this issue has only become more problematic, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection. 

In spite of these problems many organisations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don’t know how much of their encrypted traffic is decrypted and inspected.

These results are also consistent with what Australian security professionals tell us: they are not inspecting all their encrypted traffic.

While some systems allow for the inspection of internal traffic, externally generated traffic is typically ignored. As a result, cyber attackers can take advantage of these blind spots because organisations are only focused on a portion of their encrypted assets. This can lead to large scale data exfiltration events.

This is a pressing issue, but with proper oversight organisations can reduce their risks. We suggest businesses follow the following steps to protect their machine identities from encrypted tunnel threats:

Identify your keys and certificates

Many security systems now perform high speed SSL/TLS decryption. But these systems cannot decrypt traffic if they don’t have access to your keys and certificates. If you don’t have an accurate, continuously updated list of all keys and certificates, you won’t be able to inspect your SSL/TLS traffic for malicious content.

Securely distribute your keys and certificates

The scope and size of distributing keys and certificates is daunting. It's so daunting that you may be tempted to delay the deployment of decryption systems. If not handled properly, even the process of collecting and distributing keys can introduce new security and compliance risks.

Keep your keys and certificates up to date

It’s important that you keep decryption systems up to date as certificates expire or are renewed or replaced. If your certificates are outdated, the amount of decrypted traffic you’ll see is decreased, which means blind spots and security risks are likely increasing.

Automate your key and certificate security

For most organisations, having continuous visibility of all their machine identities was considered virtually impossible, as it was seen as a manual, labour-intensive process.

To keep the process airtight, organisations should utilise tools that can easily integrate with leading systems for SSL decryption, next-generation firewalls, intrusion prevention, unified threat management, secure gateways, data loss prevention, anti-malware and more.

Ultimately, encryption can simultaneously be your best friend and your worst enemy. On the positive side, encryption offers organisations a high level of assurance and risk mitigation. However, if your machine identities are vulnerable to compromises or unexpected expirations, cyber criminals can easily take advantage of your encrypted assets.

After all, the most dangerous enemies are always the ones you can’t see.

Article by Venafi APAC regional director Terrie Anderson.

Keen to learn more about why you shouldn't blindly trust encryption tunnels? Click here for details.

Story image
CrowdStrike targets Zero Trust blind spot with new offering
CrowdStrike has officially launched CrowdStrike Falcon Zero Trust Assessment (ZTA), designed to aid in overall security posture by delivering continuous real-time assessments across all endpoints in an organisation regardless of the location, network or user. More
Story image
Palo Alto Networks extends cloud native security platform with new modules
Palo Alto Networks has announced the availability of Prisma Cloud 2.0, including four new cloud security modules, thus extending its Cloud Native Security Platform (CNSP). More
Story image
Report: Power utilities increasingly at risk of devastating cyber-attacks
“Utilities’ existing systems are becoming increasingly connected through sensors and networks, and, due to their dispersed nature, are even more difficult to control.”More
Story image
Gartner names ThreatQuotient a representative vendor for SOAR
The company is listed in Gartner’s 2020 Market Guide for Security Orchestration, Automation and Response Solutions.More
Story image
New project development inhibited by cybersecurity, Kaspersky research states
"There are still some practical steps that can be taken to make sure that an emerging technology or a product reaches its launch. Cybersecurity doesn’t have to be another corporate barrier, but it should be on an integral part of the project all long."More
Story image
Majority of industrial enterprises face increase cyber threats since COVID-19
Leadership's top cyber security priority was implementing new technology solutions since the onset of the pandemic.More