Vulnerabilities / Threats
6/2/2014
11:41 AM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

SSL: Security's Best Friend Or Worst Enemy?

A new report shows that applications using SSL are on the rise in enterprises, putting them at greater risk of attacks that hide in plain sight or use vulnerabilities like Heartbleed.

A new report out today shows that applications that use SSL are on the rise in the enterprise, and that even businesses that are aware of the risks introduced by SSL aren't necessarily aware of the scale of potential problems.

The findings from the 11th annual Palo Alto Networks Application Usage and Threat Report show that around 34% of applications in use within the enterprise today use or can use the SSL to encrypt their traffic. Designed to survey the real applications running in the enterprise, it also shows the disparity between enterprise IT leaders' perception of their use of applications and the actual usage patterns or properties of applications scattered across organization. This year, the report studied 5,500 real-world environments and found approximately 2,100 applications running within these environments. Among those, 539 were SSL-capable.

As one of the core components of today's Internet ecosystem, SSL has greased the axle of Internet communication for key transactions like e-commerce and collaborative sharing applications, says Ryan Olson, head of threat intelligence for Palo Alto.

"Without having a sort of ubiquitous encryption protocol that is easy for people to implement, we wouldn't really be able to have any secure communication across the Internet," Olson says. However, the heightened level of privacy afforded by SSL encryption also brings with it a dark side.

"We certainly have a trade-off from a network perspective," he says, explaining that attackers increasingly use SSL to hide malicious traffic in plain sight from security inspection mechanisms. For example, he explains that variants of Zeus and other banking Trojans use SSL to hide command and control traffic from security devices. Similarly, the report pointed to the variant of the BlackPOS Trojan used to steal 100 million Target customer records, which used SSL to move information around using netbios shares and steal it through FTP.

"A lot of organizations are aware of this problem, but not as many as we think should be," he says. "The best way to deal with SSL is to do selective decryption of SSL traffic. We don't want to decrypt everything -- it's not really appropriate, and you don't want to invade the privacy of users in an inappropriate way. But many organizations don't do this for any applications at all. For applications which you have no idea what they are, you definitely want to have some visibility into what they are."

This is not a new problem, but it is a growing one as the number of SSL-capable applications rises within the enterprise. According to Palo Alto, the ratio grew by nearly 10 percentage points in the past year.

"I definitely don't see this decreasing over time, and it becomes even more difficult for organization as the total volume of SSL traffic increases. If you have a slice of your overall traffic you're ignoring because you're not inspecting it, as that slice grows larger the percentage of traffic that's going to include malicious behavior is going to increase proportionally," Olson says. 

Further increasing the threat is what Olson calls the long-term risks of Heartbleed, which are unknown and unpatched client-side applications vulnerable to the OpenSSL Heartbleed vulnerability. As he explains, many websites have gone through the proper stages of patching the vulnerability, reissuing certificates, and asking their users to reset their passwords. But there exists a whole world of client-side applications that organizations might not even know exist in their networks that could still be vulnerable to Heartbleed.

"Instant message application and any client-side application that could include some sort of browser in it might include OpenSSL," he says, "And it might be one of those 500-plus applications in the enterprises that can use SSL."

Palo Alto reported that "a lot of eyebrows were raised" as customers looked at the report's results. In many specific enterprise instances, the percentage of SSL-capable applications running in environments was much higher than 30%, sometimes pushing above 50% of applications in use.

"So, identifying all the applications in your network that are using SSL and figuring out if they use Open SSL is really the long tail of Heartbleed," Olson warns.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.