Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/29/2019
10:00 AM
Shane Buckley
Shane Buckley
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

4 Network Security Mistakes Bound to Bite You

It's Shark Week again! Are you ready to outmaneuver sharks of the cyber variety? These tips can help.

Just like sharks off the Florida coast, encrypted threats are lurking in network traffic. And as the volume of transport layer security (TLS) encrypted traffic rises exponentially, organizations become even more vulnerable to attacks. Ouch!

We all cringe at the reports of shark sightings each summer. If you're one of the 35 million viewers planning to partake in the cultural feeding frenzy that is Shark Week, I offer you a primer. Here we marry our shark appreciation with some serious discussion around the following four network security mistakes bound to bite you:

1. Letting familiarity fool you into complacency
Most shark attacks occur less than 100 feet from the shore, says National Geographic. But even when sharks are in close proximity to you — for example, just a few feet away from these swimmers at Daytona Beach — they're really hard to see. The same can be said for the network. It's a familiar environment, yet more than half of malware is now hiding right beneath your nose in encrypted traffic.

Pro tip: Treat encrypted traffic as an attack vector. Make sure you can quickly expose encrypted attacks, hidden command and control channels, malware, and unauthorized data exfiltration exploits. 

2. Misjudging the effectiveness of your gear
It's important to wear a hat and lather on sunscreen at the beach, but while you're focused on blocking the sun, let's not forget you could still be acting as a shark magnet, according to one researcher, depending on your tattoos, nail polish, and jewelry. Allowing for pockets of risk is much like the way operations teams want visibility into encrypted traffic, but encryption also blinds security and application monitoring tools. In order to gain visibility, decryption via Secure Sockets Layer (SSL) is needed, but it is extremely computationally intensive and can introduce network latency.

Pro tip: Before deploying any SSL decryption solution, be aware of the total volume of network traffic and how much of it is encrypted with SSL/TLS. Know how and where traffic is traversing the network. For an SSL/TLS solution to work effectively, it needs to see both directions of traffic. Asymmetric traffic can cause incomplete decryption if all traffic is not combined and fed to the solution.

3. Ignoring cloud considerations
From dusk until dawn and when dipping into murky waters, cloudy conditions carry an increased risk of shark encounters. Security leaders are navigating similar visibility challenges that come as a result of enterprises deploying more and more software to private and public clouds and making wider use of software-as-a-service applications.

Pro tip: Remember to establish a clear line of sight and to secure all data in motion, not just across the enterprise, but also cloud environments. Don't get caught like a shark out of water, which can happen when you can't see where and how network data is increasing and you end up caught in a period of catch-up that can hurt business transformation projects such as cloud adoption. Effective network visibility helps scale the network — and the business.

4. Not knowing the response plan if there's an attack
Shark Week programming will likely strike fear, but will you walk away knowing what to do if faced with an attack? (See here for advice.) When it comes to cyber sharks, only 58% of organizations feel highly confident that they could detect an important security issue before it has a significant impact.

Pro tip: Honestly appraise your threat detection and incident response tools and processes, and evaluate any architectural improvements you might need to make to stay a step ahead. Intentionally engineer your security strategy to overcome data and tool-set silos to get information to the right place at the right time, and base your architecture on a deliberate attempt to identify, respond to, and counter threats.

No security posture — or open-water swim — is absolutely safe. But taking appropriate safety measures like the ones outlined above can go a long way toward a reliable and maintainable security infrastructure. Bottom line: When it comes to swimming with sharks, visibility matters.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Shane Buckley is President and Chief Operating Officer of Gigamon with responsibility for expanding the company's business and markets worldwide. He brings more than 20 years of executive management experience to the team and joins Gigamon from Xirrus where he was CEO prior ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ajfreeland
50%
50%
Ajfreeland,
User Rank: Apprentice
8/8/2019 | 1:35:56 PM
Traditional security is not enough
Familiarity can definitely be a downside. Many companies make the push to the cloud but rely on traditional methods of data security, offering more visibility. TLS 1.3 offers data encryption but may push away companies because of less visibility. Nubeva has a new method for out of band decrypted visibility for TLS 1.3. It's called Symmetric Key Intercept. Check it out at Nubeva's website!
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15129
PUBLISHED: 2019-08-18
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_n...
CVE-2019-15130
PUBLISHED: 2019-08-18
The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID parame...
CVE-2019-15135
PUBLISHED: 2019-08-18
The handshake protocol in Object Management Group (OMG) DDS Security 1.1 sends cleartext information about all of the capabilities of a participant (including capabilities inapplicable to the current session), which makes it easier for attackers to discover potentially sensitive reachability informa...
CVE-2019-15136
PUBLISHED: 2019-08-18
The Access Control plugin in eProsima Fast RTPS through 1.9.0 does not check partition permissions from remote participant connections, which can lead to policy bypass for a secure Data Distribution Service (DDS) partition.
CVE-2019-15137
PUBLISHED: 2019-08-18
The Access Control plugin in eProsima Fast RTPS through 1.9.0 allows fnmatch pattern matches with topic name strings (instead of the permission expressions themselves), which can lead to unintended connections between participants in a Data Distribution Service (DDS) network.