Blue Coat reveals security risks hiding in encrypted traffic
Announcement posted by Blue Coat Systems 19 Nov 2014
Sydney, Australia- Nov. 19, 2014 – Blue Coat Systems, Inc., the market leader in business assurance technology, today revealed research that shows that the growing use of encryption to address privacy concerns is creating perfect conditions for cyber criminals to hide malware inside encrypted transactions, and even reducing the level of sophistication required for malware to avoid detection.
The use of encryption across a wide variety of websites—both business and consumer -- is increasing as concerns around personal privacy grow. In fact, eight of the top 10 global websitesas ranked by Alexa deploy SSL encryption technology throughout all or portions of their sites. For example, technology goliaths Google, Amazon and Facebook have switched to an “always on HTTPS” model to secure all data in transit using SSL encryption.
Business-essential applications, such as file-storage, search, cloud-based business software and social media, have long-used encryption to protect data-in-transit. However, the lack of visibility into SSL traffic represents a potential vulnerability in many enterprises where benign and hostile uses of SSL are indistinguishable to many security devices. As a result, encryption enables threats to bypass network security and allows sensitive employee or corporate data to leak from anywhere inside the enterprise. In a typical seven-day period, Blue Coat Labs receives over 100,000 requests from customers for security information about sites using HTTPS encryption protocol for command and control of malware.
Revealing the Visibility Void
As Blue Coat’s latest security report, “2014 Security Report – The Visibility Void” explains, encrypted traffic is becoming more popular with cyber criminals because:
Malware attacks, using encryption as a cloak, do not need to be complex because the malware operators believe the encryption prevents the enterprise from seeing the attack
Significant data loss can occur as a result of malicious acts by hostile outsiders or disgruntled insiders, who can easily transmit sensitive information
By simply combining short-lived websites, “One-Day Wonders,” with encryption and running incoming malware and/or outgoing data theft over SSL, organizations can be completely blind to the attack, and unable to prevent, detect or respond.
The growing use of encryption means many businesses are unable to track the legitimate corporate information entering and leaving their networks, creating a growing blind spot for enterprises. In fact, over a 12-month period beginning September 2013, between 11 per cent and 14 per cent of the security information requests that Blue Coat researchers received on average each week were asking about encrypted websites.
One example of an unsophisticated malware threat hiding in encrypted traffic is Dyre, a widely distributed, password-stealing Trojan originating in the Ukraine. After authorities shut down Zeus, one of the most successful Trojan horse malwares, Dyre quickly took its place by simply adding encryption. Today Dyre exploits human behavior to target some of the world’s largest enterprises to compromise accounts that can expose Social Security numbers, bank account information, protected health information, intellectual property and much more.
“The tug of war between personal privacy and corporate security is leaving the door open for novel malware attacks involving SSL over corporate networks that put everyone’s data at risk,” said Dr. Hugh Thompson, chief security strategist for Blue Coat. “For businesses to secure customer data and meet regulatory and compliance requirements they need the visibility to see the threats hiding in encrypted traffic and the granular control to make sure employee privacy is also maintained.”
How to Preserve Security and Privacy
Corporate security demands must be balanced with privacy policies and applicable compliance requirements. Because corporate policies and applicable compliance regulations can vary geographically on a-per organization and per industry basis, businesses need flexible, configurable, customizable and targeted decryption capabilities to meet their unique business needs. To help enterprises comply with their policy and compliance requirements while still combating threats hiding in encrypted traffic, Blue Coat has developed a list of key factors that IT security departments should consider when framing the issue within their organization. The full list of guidance is available in “The Visibility Void” report.
Report and E-Guide Available
To view a full copy of “The Visibility Void: A Dark Data Economy Threatens the Enterprise,” please visit:2014 Security Report – The Visibility Void
A new E-Guide is available for download at:https://www.bluecoat.com/etm-guide/. The E-Guide highlights:
How encrypted traffic is growing and how it is exploited
The challenges organizations face when trying to mitigate the risk
-
Practical guidance on how to eliminate the encrypted traffic blind spot
About Blue Coat Systems
Blue Coat empowers enterprises to safely and quickly choose the best applications, services, devices, data sources, and content the world has to offer, so they can create, communicate, collaborate, innovate, execute, compete and win in their markets. For additional information, please visit www.bluecoat.com.
# # #
Blue Coat and the Blue Coat logo are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document are the property of their respective owners.
Media Contacts
Elaine Banoub
+612 1223 7673