DDoS Detection, Mitigation, Orchestration, and Threat Intelligence
Consolidated Security & CGNAT
TLS/SSL Inspection
Web Application Firewall
Application Security & Load Balancing
Analytics & Management
CGNAT & IPv6 Migration
Skilled threat actors are now hiding cyber attacks in SSL-encrypted traffic. Not only do their payloads avoid inbound detection, it’s also easier for them to hide outbound activity during data exfiltration. And it’s creating serious challenges for security teams across all industries.
By the end of 2016, 67 percent of the Internet will be encrypted. In fact, popular sites (e.g., Google, Facebook) are now making SSL encryption the default. Google even ranks websites using HTTPS higher in their search algorithms. As more of the Internet shifts toward encrypted traffic, attacks hiding in SSL traffic will only grow in popularity and sophistication.
In a study,“ Hidden Threats in Encrypted Traffic: A Study of North America & EMEA,” the Ponemon Institute discovered that out of over 1,000 respondents, 80 percent had been victims of at least one cyber attack in the previous 12 months, 40 percent of which leveraged SSL encryption to bypass security.
A proven method for stopping these attacks is SSL decryption and inspection. On a basic level, your network and security appliances will:
The top reason (61 percent) their organizations haven’t implemented proper SSL decryption? Concerns over performance degradation, found Ponemon.
Implementing this technique onboard your appliance, however, is processor-intensive and will likely result in performance degradation. An organization can avoid these issues by off-loading SSL decryption to a dedicated appliance. Let’s take
Let’s take Cisco ASA and FirePOWER, for example. A trusted next-generation firewall (NGFW) and security service, this solution can block up 99.4 percent of intrusion events and 99.2 percent of advanced malware attacks.
Although it can execute on-board SSL decryption in smaller deployment scenarios, it’s not advisable as organizations scale regional, national or global enterprise networks. However, by integrating Cisco ASA with FirePOWER with an enterprise-grade SSL decryption solution — like A10 Thunder SSLi, for example — organizations can bolster security without affecting performance. This video explains why SSL offload is the best strategy.
<span style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" data-mce-type="bookmark" class="mce_SELRES_start"></span>
As we know, each deployment scenario is different. But for most organizations, it’s best practice to off-load SSL decryption and re-encryption to dedicated, high-performance solutions. The top benefits for this approach include:
For more information on SSL decryption and inspection with Cisco ASA with FirePOWER, download the in-depth solution brief.
