According to NETSCOUT Arbor, the arrival of TLS1.3, the latest advance in encryption technology, is going to require a re-think of certain mechanisms for detecting and mitigating some forms of Distributed Denial of Service (DDoS) attacks.<\/p>\n
Darren Anstee, Chief Technology Officer, NETSCOUT Arbor, says certain advances in encryption technology, including the latest version of the Transport Layer Security (TLS1.3), can make identifying and blocking some threats more difficult.<\/p>\n
He clarifies that, while encryption is an extremely valuable tool in any security arsenal – enabling users to ensure privacy when online or making mobile calls, and facilitating the secure storage and exchange of data, including personal information \u2013 it is simultaneously not a solution to all security issues, as it can be used to ill effect in ransomware.<\/p>\n
\u201cMany network-based threat and fraud detection solutions have historically relied upon transparent, passive decryption of encrypted sessions via access to the server private key(s); with the introduction of TLS 1.3 this is not as simple,\u201d said Anstee.<\/p>\n
Bryan Hamman, Territory Manager for Sub-Saharan Africa at NETSCOUT Arbor, added: \u201cOne of the key aims of encryption is to prevent so-called\u00a0\u2018Man In The Middle\u2019\u00a0(MITM) attacks, ensuring that an intermediate device that attempts to decrypt the flow cannot intercept data between the client and server.<\/p>\n
\u201cTLS is the encryption mechanism used within enterprise networks and over the public Internet and is a critical Internet security protocol. TLS is used to secure data as it is transmitted between web browsers and servers. IP-based protocols like HTTPS, SMTP, POP3 and FTP all support TLS for encryption.<\/p>\n
\u201cTLS 1.2 became the web\u2019s standard in 2008. Since then, hackers have discovered several vulnerabilities that have resulted in some high-profile cyberattacks over the last few years.\u00a0TLS1.3 should assist in this regard \u2013 it replaces TLS1.2 and became an official standard in August 2013.\u201d<\/p>\n
Describing it as \u2018a major revision designed for the modern Internet\u2019, the Internet Engineering Task Force (IETF) noted that the TLS1.3 update contains \u2018major improvements in the areas of security, performance, and privacy\u2019 and will make it harder for eavesdroppers to decrypt intercepted traffic. One of the major drivers in the design of the new protocol was the mass surveillance of Internet communications by the US National Security Agency (NSA), as revealed in 2013 by Edward Snowden.<\/p>\n
Work on TLS1.3 began in April 2014 and was on its 28th<\/sup> draft before it was finally approved in March 2018. Since then, up until August 20, 2018, engineers have been checking it to make sure that nothing in TLS1.3 will cause any major problems. They are now confident that there are no security holes in the algorithms used in TLS1.3, while the same cannot be said for 1.2.<\/p>\n \u201cTLS 1.3 dictates that Perfect Forward Secrecy (PFS) must be used \u2013 enhancing the confidentiality of our communications \u2013 but it makes us re-think our mechanisms for dealing with another set of problems, including mechanisms for detecting and mitigating some forms of DDoS attack,\u201d said Anstee.<\/p>\n