{"id":14215,"date":"2017-01-11T09:32:18","date_gmt":"2017-01-11T09:32:18","guid":{"rendered":"http:\/\/www.intelligentcio.com\/me\/?p=14215"},"modified":"2017-01-11T09:32:18","modified_gmt":"2017-01-11T09:32:18","slug":"ssl-inspection-uncovering-cyber-threats-in-ssl-traffic","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/me\/2017\/01\/11\/ssl-inspection-uncovering-cyber-threats-in-ssl-traffic\/","title":{"rendered":"SSL inspection \u2013 Uncovering cyber threats in SSL traffic"},"content":{"rendered":"<p class=\"p1\"><span class=\"s1\">Encrypted traffic accounts for a large and growing percentage of all network traffic. While the adoption of SSL, and its successor, Transport Layer Security (TLS), should be cause for celebration \u2013 as encryption improves confidentiality and message integrity \u2013 it also puts organisations at risk. This is because hackers can leverage encryption to conceal their exploits from security devices that do not inspect SSL traffic, writes <em>Mohammed Al-Moneer, Regional Director, MENA, A10 Networks.<\/em>\u00a0<\/span><\/p>\n<p class=\"p1\"><strong><span class=\"s1\">How serious is the threat?<\/span><\/strong><\/p>\n<p class=\"p1\"><span class=\"s1\">According to a recent Gartner survey, \u201cless than 20% of organisations with a firewall, an intrusion prevention system (IPS) or a unified threat management (UTM) appliance decrypt inbound or outbound SSL traffic.\u201d This means that hackers can evade over 80% of companies\u2019 network defences simply by tunnelling attacks in encrypted traffic. To stop cyber attacks, organisations must gain insight into encrypted data, and to do this, they need a dedicated security platform that can decrypt inbound and outbound SSL traffic.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>The importance of being earnest\u2026When evaluating SSL inspection platforms<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">To eliminate the SSL blind spot in corporate defences, organisations should provision solutions that can decrypt SSL traffic \u2013 both inbound traffic to corporate servers and outbound traffic from internal users to the Internet \u2013 and allow all security products that analyse network traffic to inspect encrypted data. Organisations must carefully evaluate the features and performance of SSL inspection platforms before selecting a solution. If IT security teams deploy SSL inspection platforms in haste, they might be blindsided later by escalating SSL bandwidth requirements, deployment demands or regulatory implications.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Because SSL inspection potentially touches so many different security products \u2013 from firewalls and intrusion prevent systems (IPS) to data loss prevention (DLP), forensics, advanced threat prevention and more \u2013 organisations must develop a list of criteria and evaluate SSL inspection platforms against these criteria before selecting a solution. SSL inspection platforms should:<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>Meet current and future SSL performance demands<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Performance is perhaps the most important evaluation criteria for SSL inspection platforms. Organisations must assess their current Internet bandwidth requirements and ensure that their SSL inspection platform can handle future SSL throughput requirements. When evaluating SSL inspection performance, IT security teams should:<\/span><\/p>\n<ul class=\"ul1\">\n<li class=\"li1\"><span class=\"s1\">Test SSL inspection speeds with 2048-bit and 4096-bit SSL keys.<\/span><\/li>\n<li class=\"li1\"><span class=\"s1\">Evaluate a mix of traffic with Diffie-Hellman and elliptic curve ciphers.<\/span><\/li>\n<li class=\"li1\"><span class=\"s1\">Ensure that the SSL inspection platform can handle throughput requirements, with extra headroom for traffic peaks.<\/span><\/li>\n<li class=\"li1\"><span class=\"s1\">Analyze appliance performance with essential security and networking features enabled. Testing SSL decryption speeds without considering<\/span><\/li>\n<\/ul>\n<p class=\"p1\"><span class=\"s1\">Those organisations that thoroughly evaluate performance benchmarks should be able to avoid surprises in their production environments.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>Satisfy compliance requirements<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Privacy and regulatory concerns have emerged as one of the top hurdles preventing organisations from inspecting SSL traffic. While IT security teams have deployed a wide array of products to detect attacks, data leaks and malware \u2013 and rightfully so \u2013 they must walk a thin line between protecting employees and intellectual property, and violating employees\u2019 privacy rights. To address regulatory requirements like HIPAA, Payment Card Industry Data Security Standard (PCI DSS) and Sarbanes-Oxley (SOX), an SSL inspection platform should be able to bypass sensitive traffic, like traffic to banking and healthcare sites. By bypassing sensitive traffic, IT security teams can rest easy knowing that confidential banking or healthcare records will not be sent to security devices or stored in log management systems.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>Support heterogeneous networks with diverse deployment and security requirements<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Organisations must contend with a wide array of security threats from external actors and from disgruntled employees. To safeguard their digital assets, organisations have deployed an ever increasing number of security products to stop intrusions, attacks, data loss, malware and more.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Some of these security products are deployed inline, while others are deployed non-inline as passive network monitors. Some analyze all network traffic, whereas others focus on specific applications, like web or email protocols. However, virtually all of these products need to examine traffic in clear text in order to pinpoint illicit activity.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">As a result, SSL inspection platforms should interoperate with a diverse set of security products from multiple vendors. They should support transparent deployment and be able to route traffic from one security device to another with traffic steering.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>Maximise the uptime and the overall capacity of security infrastructure<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Organisations depend on their security infrastructure to block cyber attacks and prevent data exfiltration. If their security infrastructure fails, threats may go undetected and users may be unable to perform business-critical tasks, resulting in loss of revenue and brand damage. Most firewalls today can granularly control access to applications and detect intrusions and malware. Unfortunately, analysing network traffic for network-borne threats is a resource-intensive task. While firewalls have increased their capacity over time, they often cannot keep up with network demand, especially when multiple security features like IPS, URL filtering and virus inspection are enabled. Therefore, SSL inspection platforms should not just offload SSL processing from security devices. They should also maximise the uptime and performance of these devices.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\"><b>Securely manage SSL certificates and keys<\/b><\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">Whether providing visibility to outbound or inbound SSL traffic, SSL inspection devices must securely manage SSL certificates and keys. SSL certificates and keys form the basis of trust for encrypted communications. If they are compromised, attackers can use them to impersonate legitimate sites and steal data.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">When SSL inspection devices are deployed in front of corporate applications to inspect inbound traffic, they may need to manage tens, hundreds or even thousands of certificates. As the number of SSL key and certificate pairs grows, certificate management becomes more challenging. Organizations constantly add, remove or redeploy servers to meet business needs. This fluid and dynamic environment makes it difficult for organizations to account for all SSL certificates at any given time and ensure that certificates have not expired.<\/span><\/p>\n<p class=\"p1\"><span class=\"s1\">In conclusion, privacy concerns are propelling SSL usage higher. Businesses face increased pressure to encrypt application traffic and keep data safe from hackers and foreign governments. In addition, because search engines such as Google rank HTTPS websites better than standard websites, application owners are clamouring to encrypt traffic. But IT security teams face their own set of challenges as they tackle threats like cyber attacks and malware \u2013 threats that can use encryption to bypass corporate defences. If they wish to prevent devastating data breaches, they must gain insight into SSL traffic. And to accomplish this goal, they need a dedicated SSL inspection platform.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Encrypted traffic accounts for a large and growing percentage of all network traffic. While the adoption of SSL, and its successor, Transport Layer Security (TLS), should be cause for celebration \u2013 as encryption improves confidentiality and message integrity \u2013 it also puts organisations at risk. This is because hackers can leverage encryption to conceal their [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":14216,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,6],"tags":[247,138,3560,1226],"class_list":["post-14215","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","tag-a10-networks","tag-cyber-security","tag-ssl-inspection","tag-ssl-traffic"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/14215","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/comments?post=14215"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/posts\/14215\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media\/14216"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/media?parent=14215"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/categories?post=14215"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/me\/wp-json\/wp\/v2\/tags?post=14215"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}