DDoS Detection, Mitigation, Orchestration, and Threat Intelligence
Consolidated Security & CGNAT
TLS/SSL Inspection
Web Application Firewall
Application Security & Load Balancing
Analytics & Management
CGNAT & IPv6 Migration
Since April 7th, when the Heartbleed vulnerability was publicly disclosed, IT administrators around the world have scrambled to patch web servers and to inspect and update their firewalls, mail servers, SSL VPN equipment, and just about every other device on the network that uses SSL.
IT administrators have had two good reasons to scramble. First, the Heartbleed vulnerability impacts a large swath of the Internet to the tune of 17% of all SSL-enabled web servers, according to a Netcraft survey. And second, the vulnerability is dangerous. Very dangerous. According to Heartbleed.com, it “allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software…This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.”
As A10 Networks reported in a separate blog post, A10 products are not susceptible to the Heartbleed issue. However, SSL security risks do not begin or end with this one vulnerability. In fact, a simple search on the National Vulnerability Database uncovered over 150 OpenSSL-related vulnerabilities.* And OpenSSL is not alone; security gaps have been discovered in virtually every widely-used SSL library.
In June 2013, NSA whistleblower Edward Snowden revealed the NSA used many different ways to snoop on citizens, including decrypting encrypted communications. In fact, the Snowden leaks indicate the NSA decrypted data that had been encrypted with weak or even intentionally-flawed encryption algorithms—proving once again that encryption algorithms are not infallible. With risks like the Heartbleed issue and insecure Dual_EC_DRBG number generator—developed by the NSA—organizations need to carefully evaluate the SSL implementations of their servers, networking devices, and application delivery controllers (ADCs).
One reason IT administrators are struggling to deal with Heartbleed is that they have to assess and patch dozens, hundreds, or even thousands of applications. With many of these applications running on different operating systems with different SSL libraries, administrators must spend countless hours testing, patching, and retesting their applications.
An easy way organizations can safeguard their vulnerable applications–and avoid similar fire drills in the future–is to terminate SSL traffic on their ADCs. Offloading SSL traffic not only reduces the load on application servers, it also lowers the cost of managing and updating SSL libraries. Administrators can also avoid managing SSL certificates on each individual server. And in the event of an SSL vulnerability outbreak like Heartbleed, administrators can avoid patching all of their individual servers.
At A10 Networks, security is a top priority. To ensure that we deliver the most secure, tested, and validated SSL encryption available, we apply security best practices in every step of our product design, development, and testing processes.
To demonstrate that our products meet recognized benchmarks for security and functionality assurance, we have submitted our products to the foremost standards laboratories for evaluation. A10 products have successfully achieved Federal Information Processing Standard (FIPS), Common Criteria, and Joint Interoperability Command (JITC) certification. In fact, seventeen A10 Thunder and AX Series hardware models have obtained FIPS 140-2 Level 2 certification. Virtually all A10 products are either FIPS-certified or are in the process of becoming certified.
While FIPS certification doesn’t prevent products from falling victim to a zero-day SSL vulnerability—including the Heartbleed vulnerability—it does ensure that certified products meet stringent cryptographic design and implementation requirements. This evaluation process reduces the risk that attackers will uncover vendor-specific vulnerabilities in our software and hardware.
FIPS certification entails in depth testing of SSL key management, SSL roles, services and authentication, protection against attacks, and many other software and hardware requirements. By achieving FIPS compliance, customers can be assured that A10 hardware appliances satisfy exacting SSL security requirements available.
Besides cyber-attacks and software vulnerabilities, organizations must consider physical threats, such as thieves or malicious insiders that might try to physically tamper with equipment to access digital keys.
To protect A10 hardware appliances from physical attacks like tampering and bus probing, A10 offers HSM cards on select A10 hardware appliances. These HSM cards protect SSL private keys and provide a physical assertion on access. A10’s HSM cards deliver performance and FIPS 140-2 Level 2 and 3 certification.
Besides supporting tamper-resistant HSM cards, select A10 hardware models also offer tamper-resistance, so administrators can know if an A10 appliance has been compromised or powered on or off. Coupling HSM cards for secure SSL key management with tamper-resistant hardware appliances, A10 offers the most physically-secure ADC on the market.
* A keyword search for OpenSSL in the National Vulnerability Database website revealed 152 CVEs. However, some of these vulnerabilities may be due to custom implementations or extensions to OpenSSL rather than vulnerabilities in OpenSSL itself.
Seeing is believing. Schedule a live demo today.
