Four steps organisations can take to protect against encrypted tunnel attacks

Last December, employees of the several Australian government agencies had their data exposed in a massive leak. In addition to government employees, more than 40,000 workers in the private sector were impacted by the breach. The exposed data included passwords, phone numbers, credit card information, corporate content and more.

In the aftermath of breaches on this scale, many industry experts wonder how large amounts of data can be exfiltrated without organisations noticing. Ultimately, the massive exfiltration of data is a critical symptom of weak machine identity protection.

Machine identities are used to authenticate encrypted communication between machines. The cryptographic keys and digital certificates that comprise machine identities are one of the least understood and poorly protected parts of enterprise security infrastructures.

Today, organisations spend over $8 billion protecting usernames and passwords, but they spend a fraction of that amount protecting machine identities.

Cyber criminals are taking advantage of weak machine identity security by compromising it so they can hide in encrypted traffic. Nefarious actors can use encrypted tunnels to pivot across corporate networks, eavesdrop on confidential communications, route traffic to phishing websites and gain access to sensitive corporate data.

Unfortunately, this issue has only become more problematic, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection.

In spite of these problems many organisations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don't know how much of their encrypted traffic is decrypted and inspected.

These results are also consistent with what Australian security professionals tell us: they are not inspecting all their encrypted traffic.

While some systems allow for the inspection of internal traffic, externally generated traffic is typically ignored. As a result, cyber attackers can take advantage of these blind spots because organisations are only focused on a portion of their encrypted assets. This can lead to large scale data exfiltration events.

This is a pressing issue, but with proper oversight organisations can reduce their risks. We suggest businesses follow the following steps to protect their machine identities from encrypted tunnel threats:

Identify your keys and certificates

Many security systems now perform high speed SSL/TLS decryption. But these systems cannot decrypt traffic if they don't have access to your keys and certificates. If you don't have an accurate, continuously updated list of all keys and certificates, you won't be able to inspect your SSL/TLS traffic for malicious content.

Securely distribute your keys and certificates

The scope and size of distributing keys and certificates is daunting. It's so daunting that you may be tempted to delay the deployment of decryption systems. If not handled properly, even the process of collecting and distributing keys can introduce new security and compliance risks.

Keep your keys and certificates up to date

It's important that you keep decryption systems up to date as certificates expire or are renewed or replaced. If your certificates are outdated, the amount of decrypted traffic you'll see is decreased, which means blind spots and security risks are likely increasing.

Automate your key and certificate security

For most organisations, having continuous visibility of all their machine identities was considered virtually impossible, as it was seen as a manual, labour-intensive process.

To keep the process airtight, organisations should utilise tools that can easily integrate with leading systems for SSL decryption, next-generation firewalls, intrusion prevention, unified threat management, secure gateways, data loss prevention, anti-malware and more.

Ultimately, encryption can simultaneously be your best friend and your worst enemy. On the positive side, encryption offers organisations a high level of assurance and risk mitigation. However, if your machine identities are vulnerable to compromises or unexpected expirations, cyber criminals can easily take advantage of your encrypted assets.

After all, the most dangerous enemies are always the ones you can't see.

Keen to learn more about why you shouldn't blindly trust encryption tunnels? Click here for details.