sb-as logo
Story image

Four steps organisations can take to protect against encrypted tunnel attacks

05 Feb 2018

Last December, employees of the several Australian government agencies had their data exposed in a massive leak. In addition to government employees, more than 40,000 workers in the private sector were impacted by the breach. The exposed data included passwords, phone numbers, credit card information, corporate content and more.

In the aftermath of breaches on this scale, many industry experts wonder how large amounts of data can be exfiltrated without organisations noticing. Ultimately, the massive exfiltration of data is a critical symptom of weak machine identity protection.

Machine identities are used to authenticate encrypted communication between machines. The cryptographic keys and digital certificates that comprise machine identities are one of the least understood and poorly protected parts of enterprise security infrastructures.

Today, organisations spend over $8 billion protecting usernames and passwords, but they spend a fraction of that amount protecting machine identities.

Cyber criminals are taking advantage of weak machine identity security by compromising it so they can hide in encrypted traffic. Nefarious actors can use encrypted tunnels to pivot across corporate networks, eavesdrop on confidential communications, route traffic to phishing websites and gain access to sensitive corporate data.

Unfortunately, this issue has only become more problematic, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection. 

In spite of these problems many organisations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don’t know how much of their encrypted traffic is decrypted and inspected.

These results are also consistent with what Australian security professionals tell us: they are not inspecting all their encrypted traffic.

While some systems allow for the inspection of internal traffic, externally generated traffic is typically ignored. As a result, cyber attackers can take advantage of these blind spots because organisations are only focused on a portion of their encrypted assets. This can lead to large scale data exfiltration events.

This is a pressing issue, but with proper oversight organisations can reduce their risks. We suggest businesses follow the following steps to protect their machine identities from encrypted tunnel threats:

Identify your keys and certificates

Many security systems now perform high speed SSL/TLS decryption. But these systems cannot decrypt traffic if they don’t have access to your keys and certificates. If you don’t have an accurate, continuously updated list of all keys and certificates, you won’t be able to inspect your SSL/TLS traffic for malicious content.

Securely distribute your keys and certificates

The scope and size of distributing keys and certificates is daunting. It's so daunting that you may be tempted to delay the deployment of decryption systems. If not handled properly, even the process of collecting and distributing keys can introduce new security and compliance risks.

Keep your keys and certificates up to date

It’s important that you keep decryption systems up to date as certificates expire or are renewed or replaced. If your certificates are outdated, the amount of decrypted traffic you’ll see is decreased, which means blind spots and security risks are likely increasing.

Automate your key and certificate security

For most organisations, having continuous visibility of all their machine identities was considered virtually impossible, as it was seen as a manual, labour-intensive process.

To keep the process airtight, organisations should utilise tools that can easily integrate with leading systems for SSL decryption, next-generation firewalls, intrusion prevention, unified threat management, secure gateways, data loss prevention, anti-malware and more.

Ultimately, encryption can simultaneously be your best friend and your worst enemy. On the positive side, encryption offers organisations a high level of assurance and risk mitigation. However, if your machine identities are vulnerable to compromises or unexpected expirations, cyber criminals can easily take advantage of your encrypted assets.

After all, the most dangerous enemies are always the ones you can’t see.

Article by Venafi APAC regional director Terrie Anderson.

Keen to learn more about why you shouldn't blindly trust encryption tunnels? Click here for details.

Story image
Video: 10 Minute IT Jams - protecting data with user behaviour analytics
In this video, Forcepoint senior sales engineer and solutions architect Matthew Bant discusses the company's DLP solution, the importance of integrating compliance into security solutions, and why cybersecurity strategies should take a more people-based approach.More
Story image
BlackBerry partners with ServiceNow for incident response management
BlackBerry has announced it has entered into a partnership with ServiceNow to integrate the BlackBerry AtHoc service within the Now platform for rapid crisis communications and IT service management. More
Story image
Creating private data regulations for employees
Whether employees are hired on a part-time or full-time basis, everyone must know about data privacy regulations. Everyone needs to be responsible for keeping the organisation’s data secure. More
Story image
Surfshark rolls out WireGuard open source VPN protocol
When there is less code in a VPN, it is less susceptible to security vulnerabilities due to easier configuration and management, according to Surfshark.More
Story image
COVID-related email subjects biggest threat in phishing scams
Coronavirus-related email subjects remain the biggest threat in phishing scams, a new study has found.More
Story image
BlueVoyant acquires Managed Sentinel, builds out Microsoft MSS offerings
“Combining Managed Sentinel’s Azure Sentinel deployment expertise with BlueVoyant’s MDR capabilities will help customers operationalise and maximise Microsoft security technologies."More