DDoS Detection, Mitigation, Orchestration, and Threat Intelligence
Consolidated Security & CGNAT
TLS/SSL Inspection
Web Application Firewall
Application Security & Load Balancing
Analytics & Management
CGNAT & IPv6 Migration
Today, encryption has become ubiquitous — Google reports that as of June 1, 2019, 94 percent of traffic across all its products and services is encrypted. Google is not the only company reporting a rise in the use of encryption though; all the commonly used browsers, including Safari and Mozilla, are witnessing the same trend.
So, what does this rising wave of encryption mean for organizations, and what can they do about it? That’s what we’ll explain ahead.
Read on to learn:
The biggest benefit of traffic encryption is, of course, privacy. After all, if you’re shopping or banking online, you don’t want your credit card number or any other pieces of personally identifiable information (PII) to be seen by anyone else.
To ensure that such privacy is maintained for internet users, a variety of laws like the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) have been established around the world.
The protective nature of encryption can easily be misused to hide criminal activities. For organizations, encryption can create a large blind spot that makes it difficult or impossible to identify criminal attacks.
For instance, if 80 percent of an organization’s traffic is encrypted, and they lack a proper SSL decryption solution, they’ll only be able to see and analyze 20 percent of their traffic.
That leaves a huge gap where attackers can freely infiltrate the network regardless of any firewalls or other defenses.
These are just some of the ways that attackers can use encryption to their advantage:
Once an organization’s system has been compromised, their sensitive data can then be quickly smuggled out and sent to the attacker.
Or, in the case of ransomware, it can be encrypted and held for ransom indefinitely. That data can include credit card information, names, addresses and more.
To put it simply, organizations can’t be truly secure unless they have complete visibility into their traffic, encrypted or otherwise.
Cybersecurity issues aside, encryption can have serious implications in terms of both compliance and productivity.
When it comes to compliance, it’s clear that with the recent proliferation of GDPR and CCPA, organizations are required to encrypt traffic. In failing to do so, they can find themselves facing sky-high fines.
For example, CCPA, which goes into effect in January 2020, permits fines of up to $2,500 per unintentional violation. For intentional violations, that number jumps to $7,500.
However, as discussed above, encryption can introduce its own set of challenges. In this case, if an encrypted data breach happens, organizations will be held responsible and once again face huge fines and penalties.
At the same time, compliance standards like HIPAA (Health Insurance Portability and Accountability Act of 1996) also require organizations not to decrypt healthcare data to maintain complete user privacy.
Encryption can also have severe consequences on productivity as well. With the rise in encryption, we can also see a rise in the use of encryption as a delivery mechanism for malware and ransomware.
The encrypted malware and ransomware can easily blend in with legitimate encrypted traffic and, without full visibility into the traffic, slip into the network undetected.
Once delivered and installed, the malware or ransomware can wreak havoc in the network, spreading across machines and stopping everything in its tracks.
Take, for example, the city of Baltimore, Maryland. In May of 2019, it was struck with a catastrophic ransomware attack that rendered major components of its municipal computer systems useless. These included voice mails, emails, a fine database and a payment system.
The attackers used a ransomware variant called RobbinHood, a Trojan horse type of malware. This variant is so new that its precise delivery method is still unknown.
For the systems affected by the breach, the attack was crippling. Officials were unable to verify 14,000 sewer charges, home sales were delayed and Baltimore politician Bernard “Jack” Young estimated that the total cost of the attack would be $18 million.
With that in mind, it’s plain to see how cyber attacks that abuse encryption can cause organizations’ productivity to plummet.
There’s also an interesting performance dynamic when talking about SaaS applications.
Many businesses are moving most of their productivity software, like Microsoft Office 365, to the cloud. Traditionally with legacy enterprise deployments, traffic was going east-west between your users and on-premises applications.
Now with SaaS applications in the cloud, your traffic is going north-south between the users and the cloud. This means that all of your traffic needs to go out of your network, through your security stack before going out to the internet.
Oftentimes, the security stack that companies use is not prepared for such loads, and can create bottlenecks within your network, adding network latency and deteriorating the user experience.
You can imagine how these issues could be magnified when enterprises have multiple global locations.
To alleviate these issues, SaaS providers like Microsoft recommend that organizations perform local breakout to improve performance. Local breakout works by separating SaaS traffic at the branch level, diverting it directly to the cloud.
This improves performance but creates another problem: lack of visibility into SaaS traffic.
Full visibility is essential for enterprises to increase their cybersecurity, remain productive and avoid things like non-compliance. So how do you do that? SSL decryption.
Organizations must decrypt their SSL/TLS traffic to:
By implementing effective SSL decryption, companies can avoid the loss of productivity and hefty fines associated with a data breach.
It’s essential that companies deploy SSL decryption on the edge of their enterprise network. That’s because companies usually have a security stack comprised of multiple cybersecurity solutions and devices, and as discussed above, these devices are ineffective without decryption.
In such a multi-device, multi-vendor environment, traffic must be decrypted for the entire security stack without causing major disruptions.
In other words, companies should seek out SSL decryption solutions that support and enhance their existing cybersecurity infrastructure.
Ideally, those solutions should be dedicated. Although many next-generation firewalls (NGFWs) are capable of decryption, they fail to decrypt nearly as effectively or efficiently as a dedicated decryption product.
In fact, a 2018 research from NSS Labs found that NGFWs with SSL decryption/TSL decryption turned on caused an:
Clearly, it’s not financially feasible for companies to either keep buying increasingly expensive NGFWs or to settle for a significant drop in performance and poor user experience.
Instead, organizations should be looking at dedicated decryption solutions.
We have discussed how SSL decryption solutions that can selectively decrypt traffic is essential to protect user privacy and data, and enable and enhance existing defenses against encrypted threats.
But, as organizations grow and expand into multiple locations, it becomes hard to keep track of the policies applied across all the decryption devices.
In order to maintain foolproof cybersecurity and to apply uniform policies across all locations, a centralized management solution becomes essential, so that no security loopholes are left.
However, in terms of compliance, some data regulations only apply to certain regions, while others only apply to certain types of data.
Therefore, the centralized management solution needs to be flexible enough that different policies can be created for different regions and deployments.
Finally, the centralized management solution should also be coupled with a visibility solution, so that all the devices deployed across multiple locations, can be monitored from a central location.
This also strengthens the security as any traffic events or anomalies occurring across multiple locations can be detected and acted upon immediately.
Having full traffic visibility simultaneously across all branches as well as the cloud also provides insight into the traffic bypassed for SaaS optimization at the branches, eliminating the adverse effects of local breakout.
