Story image

Four steps organisations can take to protect against encrypted tunnel attacks

05 Feb 2018

Last December, employees of the several Australian government agencies had their data exposed in a massive leak. In addition to government employees, more than 40,000 workers in the private sector were impacted by the breach. The exposed data included passwords, phone numbers, credit card information, corporate content and more.

In the aftermath of breaches on this scale, many industry experts wonder how large amounts of data can be exfiltrated without organisations noticing. Ultimately, the massive exfiltration of data is a critical symptom of weak machine identity protection.

Machine identities are used to authenticate encrypted communication between machines. The cryptographic keys and digital certificates that comprise machine identities are one of the least understood and poorly protected parts of enterprise security infrastructures.

Today, organisations spend over $8 billion protecting usernames and passwords, but they spend a fraction of that amount protecting machine identities.

Cyber criminals are taking advantage of weak machine identity security by compromising it so they can hide in encrypted traffic. Nefarious actors can use encrypted tunnels to pivot across corporate networks, eavesdrop on confidential communications, route traffic to phishing websites and gain access to sensitive corporate data.

Unfortunately, this issue has only become more problematic, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection. 

In spite of these problems many organisations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don’t know how much of their encrypted traffic is decrypted and inspected.

These results are also consistent with what Australian security professionals tell us: they are not inspecting all their encrypted
traffic.

While some systems allow for the inspection of internal traffic, externally generated traffic is typically ignored. As a result, cyber attackers can take advantage of these blind spots because organisations are only focused on a portion of their encrypted assets. This can lead to large scale data exfiltration events.

This is a pressing issue, but with proper oversight organisations can reduce their risks. We suggest businesses follow the following steps to protect their machine identities from encrypted tunnel threats:

Identify your keys and certificates

Many security systems now perform high speed SSL/TLS decryption. But these systems cannot decrypt traffic if they don’t have access to your keys and certificates. If you don’t have an accurate, continuously updated list of all keys and certificates, you won’t be able to inspect your SSL/TLS traffic for malicious content.

Securely distribute your keys and certificates

The scope and size of distributing keys and certificates is daunting. It's so daunting that you may be tempted to delay the deployment of decryption systems. If not handled properly, even the process of collecting and distributing keys can introduce new security and compliance risks.

Keep your keys and certificates up to date

It’s important that you keep decryption systems up to date as certificates expire or are renewed or replaced. If your certificates are outdated, the amount of decrypted traffic you’ll see is decreased, which means blind spots and security risks are likely increasing.

Automate your key and certificate security

For most organisations, having continuous visibility of all their machine identities was considered virtually impossible, as it was seen as a manual, labour-intensive process.

To keep the process airtight, organisations should utilise tools that can easily integrate with leading systems for SSL decryption, next-generation firewalls, intrusion prevention, unified threat management, secure gateways, data loss prevention, anti-malware and more.

Ultimately, encryption can simultaneously be your best friend and your worst enemy. On the positive side, encryption offers organisations a high level of assurance and risk mitigation. However, if your machine identities are vulnerable to compromises or unexpected expirations, cyber criminals can easily take advantage of your encrypted assets.

After all, the most dangerous enemies are always the ones you can’t see.

Article by Venafi APAC regional director Terrie Anderson.

Keen to learn more about why you shouldn't blindly trust encryption tunnels? Click here for details.

Cryptomining apps discovered on Microsoft’s app store
It is believed that the eight apps were likely developed by the same person or group.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Swiss Post asks public to hack its e-voting system
Switzerland’s postal service Swiss Post is inviting keen-eyed security experts and white hats to hack its e-voting system.
Spoofs, forgeries, and impersonations plague inboxes
It pays to double check any email that lands in your inbox, because phishing attacks are so advanced that they can now literally originate from a genuine sender’s account – but those emails are far from genuine.
Flashpoint signs on emt Distribution as APAC partner
"Key use cases that we see greatly benefiting the region are bolstering cybersecurity, combating insider threats, confronting fraud, and addressing supply chain risk, to name a few."
The attack surface: 2019's biggest security threat
As businesses expand, so does their attack surface – and that may be the biggest cybersecurity risk of them all, according to Aon’s 2019 Cyber Security Risk Report.
Opinion: Cybersecurity as a service answer to urgent change
Alan Calder believes a CSaaS model can enable a company to build a cyber resilience strategy in a coherent and consistent manner.
Why SD-WAN is key for expanding businesses - SonicWall
One cost every organisation cannot compromise on is reliable and quick internet connection.