Encryption can keep bad actors from peeking at critical data, but it can also allow them to hide malicious activity from network defenders. That’s why LiveAction, a network visibility company, has introduced ThreatEye NV, a platform that gives SecOps teams powerful tools to find threats and anomalies in encrypted traffic.
“In 2014, about 30% of traffic was encrypted. Now it’s 80% to 90%. By the end of 2025, it will be almost all traffic,” says LiveAction Director of Product Marketing Thomas Pore. “For a network defender, this creates a problem. If you’re unable to get visibility into these encrypted tunnels and connections, how can you identify threats?”
Ed Cabrera, chief cybersecurity officer at Trend Micro adds: “Encrypted traffic provides more opportunities for cybercriminals to forge or create legitimate SSL/TLS certificates for their credential phishing sites, deliver malware using encrypted C2 servers, and exfiltrate stolen data using asymmetric and symmetric encryption.”
ThreatEye can analyze more than 150 packet traits and behaviors
LiveAction explained in a news release that ThreatEye uses Deep Packet Analysis to eliminate the need to decrypt network traffic and inspect it for malicious payloads. The platform can analyze more than 150 packet traits and behaviors across multi-vendor, multi-domain, and multi-cloud network environments.
That helps accelerate real-time threat detection, eliminates encryption blindness, validates encryption compliance, and allows teams to better secure the entire network and coordinate responses with other security tools such as SIEM and SOAR, the company added.
Other benefits of the platform include:
- Real-time threat and anomaly detection
- Elimination of encryption blindness without decryption or performance degradation
- Simple deployment through a SaaS model with software sensors that can be deployed anywhere visibility is needed
- SOC support, including dashboards to drive response efficiency
- Use of machine-learning models custom-built for specific security and visibility use cases
91.5% of malware discovered and blocked was in encrypted traffic
“Web encryption and encryption, in general, are good things. They serve a huge business purpose we all want,” says Corey Nachreiner, CSO of Watchguard,
a network security company in Seattle, Washington. “Unfortunately, it offers easy and new ways for threat actors to hide from traditional and legacy security controls.”
Watchguard tackles the encryption blindness problem with a network appliance. Inside the appliance the traffic is decrypted, inspected, encrypted again, and sent on its way. The approach doesn’t seem to be very popular, though. Nachreiner concedes that only about 20% of Watchguard’s customers use the feature. “Setting it up does require some effort from an administrator,” he admits.
However, there are some significant benefits to making the effort to set up the process. Nachreiner notes that in the organizations using decryption, 91.5% of the malware discovered and blocked was in encrypted traffic.
Encrypted traffic analysis the future for fortifying security posture
“The world has shifted from a security response perspective,” Pore says. “Security analysts can’t rely on only syslog messages to identify challenges. We need to leverage machine learning and identify network traffic and patterns for these advanced attacks.”
Pore adds that encryption will continue to get better, making it more difficult and expensive for solutions that depend on decrypting and re-encrypting data to address the issue of encryption blindness. “In future versions of encryption, you’ll have zero visibility,” he says. “That will be a massive problem for defenders. That’s why encrypted traffic analysis is really going to be the future for fortifying an organization’s security posture.”
Copyright © 2022 IDG Communications, Inc.
