Xio's Proxy Page

SECTION 1

Nearly 90% of all Internet traffic is encrypted—and we’re quickly moving toward an Internet where that will be true of nearly every piece of data in transit. Although this is great for privacy and confidentiality, it creates a serious blind spot for security.

71%

of malware installed through phishing is hiding in encryption.

F5 Labs Threat Intelligence

ENCRYPTED MALWARE: THE HIDDEN THREAT

By taking advantage of encryption, attackers can bypass most inspection devices to deliver malware inside the network. In addition, encrypted data exfiltration bypasses security tools without scrutiny. F5 Labs threat research shows that 71% of malware uses encryption to hide when it communicates back to command and control locations. Additionally, 57% of malware sites and 95% of phishing sites were accessed just one time, complicating incident response investigations.

Cybercriminals know that organizations have trouble decrypting and inspecting traffic—and they use that to their advantage. Using malware such as spyware, ransomware, and rootkits, as well as exploits, attackers compromise users, networks, and applications to steal personal data.

In 2018, 28% of all data breaches involved some form of malware according to the Verizon 2019 Data Breach Investigations Report. In addition to being used by criminal organizations for financial gain, malware is increasingly employed by state-sponsored entities to disrupt other countries and commit espionage. 

 

Gaining better visibility into encrypted traffic is one of the most important steps you can take to protect your applications and your business. 

This problem isn’t new. Over the years, the cyber security industry has designed many tools to detect or block malware and malicious traffic. Organizations deploy technologies such as next-generation firewalls to watch user behavior, sandboxes to find zero-day exploits, intrusion protection systems to block malicious payloads, data loss prevention scanners to prevent data exfiltration, and web gateway services to secure inbound and outbound traffic. 

These solutions evolved over the years to become adept at preventing malware from infecting users’ systems and compromising corporate networks or applications. However, they weren't designed for encryption/decryption at scale, so they can't examine what's inside the encrypted traffic. The rise of encrypted data created an opportunity for attackers—and a headache for network administrators. Making matters worse, many inspection devices can’t keep pace with the rapidly changing encryption landscape, such as requirements for Perfect Forward Secrecy (PFS) in TLS 1.3, resulting in blind spots or performance degradation. If you want to keep your apps, your data, and your organization protected against malware, you can’t afford to be blind to encryption.

 

Bad actors leverage encryption to evade detection, and phishing is one of the more popular attack scenarios.

HOW PHISHING AND MALWARE EVADE DETECTION

Encrypted malware is one of the most serious threats to the enterprise, and can lead to financial losses, reputation damage, service disruption, and data breaches. Compounding the problem is the fact that any time your users access an infected website or click on a malicious attachment in a phishing email, they can pick up a nasty piece of malware.

Malware loves encryption that allows it slip through your traffic undetected, and phishing is one of the more popular attack scenarios. Free and low-cost HTTPS certificate providers make it easier for attackers to infiltrate malware and exfiltrate stolen assets. In the 2019 Application Protection Report, F5 Labs found that phishing was responsible for 21% of breaches. Learn how that happens using phishing malware in this short video.

DEFENDING AGAINST ENCRYPTED THREATS

If you want to keep your apps, your data, and your organization protected against malware, you can’t afford to be blind to encryption. Gaining better visibility into encrypted traffic is one of the most important steps you can take today. The question remains, what’s the best way to do that without degrading application performance? Read the article to help answer that question.  

SECTION 2

Not long ago, the Secure Sockets Layer (SSL), or Transport Layer Security (TLS), was used almost exclusively by government agencies and large financial institutions. Today, TLS 1.3 is used by organizations of all kinds to protect their data transmitted through countless sites and applications.

.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    
.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    
.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    

86%

Almost 86% of all page loads over the web are now encrypted with HTTPS.

F5 Labs Threat Intelligence

THE RISE OF TLS 1.3

The adoption of SSL/TLS has been sped up by regulatory standards such as PCI DSS, HIPAA, and the EU’s General Data Protection Regulation (GDPR), which require that transmitted data be encrypted. Moreover, organizations have been spurred to adopt SSL/TLS by Google search results policy, which gives preferential treatment to sites that encrypt.

However, the rise of SSL/TLS isn’t all good news. Attackers are increasingly hiding insidious attacks within encrypted traffic—which means that the security protocol itself has become a threat vector. Regaining visibility into that encrypted traffic is one of the most important steps you can take to protect your apps, your data, and your business.

 

 

 

WHAT IS TLS 1.3?

When a web client (Internet browser) connects to a secure website, the data is encrypted. But, how does all that happen? What type of encryption is used, and how does the Internet browser know what type of encryption the web server wants to use? This is all determined by what is known as a TLS Cipher Suite. See how it all works in this video.  

 

 

 

THE TLS 1.3 HANDSHAKE 

The handshake process between client and server has changed dramatically with the new TLS 1.3 protocol. The new process is much more efficient and allows encrypted application data to flow much faster than in previous versions. In this video, we outline the TLS 1.3 handshake and all the cool new features it has.

UPGRADING TO TLS 1.3

Encryption standards are constantly evolving, so it’s crucial to stay up to date with current best practices. The newest version of the TLS protocol (version 1.3) was recently approved by the Internet Engineering Task Force (IETF). There are several key changes in this protocol, such as a requirement to use ciphers that support Perfect Forward Secrecy (PFS), and the introduction of a zero round-trip time handshake for session resumption. In this video, we outline many of the important features of this new protocol. 

TLS ADOPTION IN THE ENTERPRISE

TLS 1.3 has been approved by the IETF and contains major improvements in the areas of security, performance, and privacy. The performance boost TLS 1.3 offers is a welcome upgrade, but there are some security challenges with PFS which makes decryption and inspection increasingly difficult.

However, PFS also removes the ability to perform passive inspection and makes it tougher to spot malicious traffic and defend against attacks hidden in that encrypted traffic. To learn more about organizations' strategies, policies and approaches to TLS 1.3 deployments, read the TLS 1.3 Adoption in the Enterprise report.

75%

of IT practitioners said their top concern about encryption was their ability to monitor application security.

SECTION 3

The growth of SSL/TLS traffic has forced organizations to find solutions that enable their network and their applications to respond to the increased demands of widespread encryption. 

.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    
.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    
.     .     .     .    .     .     .     .     .     .     .     .     .    .     .     .     .     .     .     .     .     .    

DOING NOTHING IS A RECIPE FOR DISASTER

Many organizations are not equipped to detect malware hidden in encrypted traffic using their existing security stack. However, as attackers increasingly conceal their malicious code in traffic that security devices can’t see, the do-nothing option is a recipe for disaster. It also wastes money spent on inspection tools, and the effort spent maintaining them. On the surface, it seems there are several options—but only one of them is truly effective.