Encryption is like beer goggles

February 2018 Cyber Security

Encryption has become key to protecting the privacy of electronic communication – and for certain transactions, encryption is a legal requirement – but it’s a bit like beer goggles, it makes everything look a lot rosier than it is. With between 50% and 70% of online traffic now encrypted, it is safe to say that some of that traffic is concealed malware. This is according to Brenwin Traill from Securicom.

“Nowadays, any secure website you access changes the traffic before it’s transmitted over the Internet to be completely unrecognisable to anyone who might be able to eavesdrop the traffic. In technical terms, any HTTPS or SSL traffic is encrypted. This is to protect sensitive data, banking details, ID numbers, corporate deals and secrets. It also extends to social media and streaming too, with over 70% of all browser based traffic now encrypted.

“The thing is that cybercriminals are using encryption too; to conceal malware and hide their advances. So while it is a crucial tool for protecting the privacy of users and information, it is also a thorn in the side for IT security. Due to its nature, HTTPS traffic is designed to give end-to-end encryption between a browser and a server. This means that security devices are blind to this traffic and cannot monitor or block this traffic based on the corporate policy.

Gartner has suggested that encrypted traffic will be the conduit for more than 70% of web-based malware by 2020 and that over 60% of companies will fail to decrypt it. Next generation firewalls are currently the most commonly used and effective methods for monitoring and analysing traffic.

“In addition to being able to recognise and understand different languages, next generation firewalls also have additional tools in their toolkits which make them more secure than traditional firewalls. For instance, they can inspect and block suspicious app-traffic which is very relevant with the massive volumes and types of apps that are at play nowadays. In addition, bypass policies can be setup to not inspect certain traffic in line with banking and health industry regulations.

“However, tools for analysing encrypted traffic should be integrated into security systems to effectively monitor and decrypt traffic without slowing down the network or without compromising the integrity of the encryption.

“All traffic should be inspected for threats. Your web security products should cater for this, be flexible and cater for on and off network operation,” concludes Traill.

For more information contact Securicom at www.securicom.co.za


Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Governing cybersecurity from the top as a strategic business enabler
Cyber Security
C-Suite executives still do not take cybersecurity seriously enough, while boards are not nearly as engaged in cybersecurity as they are in other areas of oversight.

It is time to take a quantum leap in IoT cybersecurity
Drive Control Corporation Cyber Security
IoT has become integrated everywhere, including enterprises. While it offers many benefits, such as increased productivity and the rollout of mission critical applications, it can also lead to (enterprise) cyber-attack vulnerabilities.

What to do in the face of growing ransomware attacks
Technews Publishing Cyber Security Security Services & Risk Management
Ransomware attacks are proliferating, with attackers becoming more sophisticated and aggressive, and often hitting the same victims more than once, in more than one way.

Can we reduce cyberattacks in 2023?
Cyber Security
Zero-trust cybersecurity strategy with simplicity and risk reduction at the heart is mandatory to reduce exponential cyberattacks in 2023, says GlobalData.

Key success factors that boost security resilience
Cyber Security
Adoption of zero trust, secure access service edge and extended detection and response technologies, all resulted in significant increases in resilient outcomes, as are executive support and cultivating a security culture.

Enterprise threats in 2023
News Cyber Security
Large businesses and government structures should prepare for cybercriminals using media to blackmail organisations, reporting alleged data leaks, and purchasing initial access to previously compromised companies on the darknet.

CA Southern Africa unmasks container security
Technews Publishing IT infrastructure Cyber Security
Adoption of software containers has risen dramatically as more organisations realise the benefits of this virtualised technology.

Shifts in threat landscape to industrial control systems
Cyber Security
Kaspersky’s ICS CERT researchers’ predictions include increased attack surface due to digitisation, activities of volunteer and cybercriminal insiders, ransomware attacks on critical infrastructure as well as the technical, economic and geopolitical effects, and the rise of potential vulnerabilities being exploited by attackers.

Advanced persistent cybercrime
Cyber Security
FortiGuard Labs predicts the convergence of advanced persistent threat methods with cybercrime. Advanced persistent cybercrime enables new wave of destructive attacks at scale, fuelled by Cybercrime-as-a-Service.

Digital razor wire: sharpening endpoint protection
Cyber Security
Crypto-mining, hacking, vulnerabilities, and threats – protecting the organisation’s endpoints has never been more important than it is today, says Reggie Nkabinde, consultant: modern platform-security at Altron Karabina.