[September 28, 2017]

Venafi Media Alert: 5 Ways Attackers Can Take Advantage of Encrypted Tunnels

In the aftermath of the Equifax breach, many consumers are wondering how cyber criminals could exfiltrate large amounts of data while remaining undetected. Unfortunately, cyber attackers have become increasingly proficient at hiding in encrypted tunnels. For example, a study from A10 Networks found that 41 percent of cyber attacks use encryption to evade detection.

Many organizations, though, are not actively examining the encrypted traffic in their network. According to a recent Venafi survey, roughly a quarter (23%) of security professionals don't know how much of their encrypted traffic is decrypted and inspected.

"As organizations encrypt more traffic and machine identity usage skyrockets, so do the number of opportunities for cyber criminals," said Nick Hunter, senior technical manager for Venafi. "Any type of encrypted tunnel can be exploited in a cyber attack, and most organizations manage hundreds of thousands of keys and certificates each day. This use will only grow, and the dramatic increase of keys and certificates will only make the job of securing encrypted tunnels more difficult. Ultimately, organizations must secure their encrypted tunnels or risk being at the mercy of cyber attackers."

Venafi security experts point out that without proper insigt into encrypted tunnels, cyber attackers can use them against businesses in the following five ways:

1. Undetected movement across networks - Most large organizations use virtual networks to connect with multiple offices and business partners. However, the encrypted tunnels in virtual networks are rarely inspected, allowing attackers to go undetected. Cyber criminals can use these tunnels to move from site-to-site.
2. Eavesdropping on confidential traffic to steal data - The most common types of tunnels are found in layered security, such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS). These tunnels provide a secure session between a browser and an application server. However, attackers may create man-in-the-middle attacks to eavesdrop on encrypted traffic and steal data from their victims.
3. Access to endpoints - To secure internet communication, organizations create virtual networks using Internet Protocol Security (IPsec). This often creates a tunnel from a remote site into a central site, creating an ideal entry point for cyber criminals. This type of attack typically compromises only established network endpoints, but it can be the start of a more sophisticated attack.
4. Setting up phishing websites - Attackers often use stolen or compromised certificates to establish a phishing website that a victim's browser will trust. Users may then unwittingly share sensitive data with cyber attackers. Since HTTPS sessions are trusted - and rarely inspected - these attacks typically go unnoticed.
5. Privileged access to payloads - The tunnels created by Secure Shell (SSH) encryption are lucrative targets for attackers. SSH keys grant administrators privileged access to applications and systems, bypassing the need for manually typed authentication credentials. Unfortunately, this also means the compromised SSH tunnels can create an ideal environment for moving malicious payloads between file servers and applications.

"On a positive note, there are ways organizations can confront this threat," concluded Hunter. "Businesses must establish a baseline of machine identities that are trusted, regularly scan for untrusted identities and take a proactive approach to securing all machine identities. To do this, organizations need to centralize and review gathered intelligence and use automation to frequently rotate keys and certificates as often as they require a username and password to be changed. This can ensure all security tools organizations rely on maintain a continuously updated list of the relevant keys and certificates they need to inspect in their encrypted traffic. By protecting these machine identities and by integrating this data into security tools, security professionals can finally begin to shine a light into encrypted tunnels."

For more information, please visit:
https://www.venafi.com/solutions/encryption-and-authorization/eliminate-blindspots.

About Venafi

Venafi is the cyber security market leader in machine identity protection, securing machine-to-machine connections and communications. Venafi protects machine identity types by orchestrating cryptographic keys and digital certificates for SSL/TLS, IoT, mobile and SSH. Venafi provides global visibility of machine identities and the risks associated with them for the extended enterprise - on premises, mobile, virtual, cloud and IoT - at machine speed and scale. Venafi puts this intelligence into action with automated remediation that reduces the security and availability risks connected with weak or compromised machine identities while safeguarding the flow of information to trusted machines and preventing communication with machines that are not trusted.

With 31 patents currently in its portfolio, Venafi delivers innovative solutions for the world's most demanding, security-conscious Global 2000 organizations. Venafi is backed by top-tier investors, including Foundation Capital, Intel Capital (News - Alert), Origin Partners, Pelion Venture Partners, QuestMark Partners, Mercato Partners and NextEquity. For more information, visit: www.venafi.com.

View source version on businesswire.com: http://www.businesswire.com/news/home/20170928005142/en/

[ Back To TMCnet.com's Homepage ]