Keeping Up With Encryption in 2020 – Security Boulevard

Encryption has become key to many cyber defense strategies, with organizations looking to more securely protect their data and privacy, as well as meet stricter compliance regulations including Europes GDPR and the California Consumer Privacy Act. Its use is unsurprisingly on the rise, with Gartner estimating that over 80% of enterprise web traffic was encrypted in 2019 and Google currently offering the HTTPS protocol as standard to 94% of its customers, putting the company well on its way to its goal of 100% encryption this year.

From WhatsApps end-to-end encrypted messages to secure online banking, encryption is everywhere. Cryptographic protocols Secure Socket Layer (SSL) and its successor, Transport Layer Security (TLS), ensure organizations protect the important data on their networks while remaining compliant. Though some authorities believe they should have backdoor access to this content, tech giants and whistleblowers alike have condemned the idea, with Facebook stating it would undermine the privacy and security of people everywhere, and Edward Snowden claiming it would be the largest [] violation of privacy in history.

However, for all its privacy and data protection benefits, encryption has unintentionally created a new threat: encrypted malware. Cybercriminals are using the very aspects that make encryption so appealing for their own means and increasingly leveraging cryptographic protocols to provide cover for their attacks. As more companies adopt encryption, hackers will have even more places to hide.

Many organizations have had firsthand experience of encrypted malware attacks. Here are just some of 2019s higher-profile attacks that hid among encrypted traffic flows between compromised network servers and command and control centers, as a way to avoid being detected by IDS and other anti-malware solutions:

Emotet, TrickBot and Ryuk have also been dubbed a triple-threat, with Emotet and TrickBot trojans being used to deliver Ryuk ransomware, causing even more damage to the affected organizations.

The biggest issue with encrypted malware attacksand the primary reason the above examples were so successfulis that they are nearly impossible to detect, with many commonly deployed solutions offering woefully inadequate protection.

The challenge for organizations looking to spot and stop encrypted malware attacks is being able to see inside their encrypted data flows. To achieve this, many organizations decrypt the traffic entering and leaving their networks, before scanning it for threats and then re-encrypting it. While in principle this technique should work, the decryption approach comes with a whole host of issues.

First, it raises concerns around compliance. Since all encrypted traffic has to decrypted to be inspected, there is a very real risk that some sensitive information will, for a brief time at least, be visible in plaintext. Secondly, there are the huge financial costs and latency issues to consider with costs growing and network performance being severely impacted by the amount of data that has to be processeda problem that will only grow in correlation with an increase in encrypted data.

A more recentand potentially biggerproblem is that decryption will no longer be possible thanks to the introduction of TLS 1.3. This cryptographic protocol, ratified by the IETF in 2018, includes stronger encryption and streamlined authentication processes, but also flags any decryption attempt as a man-in-the-middle attack, immediately terminating the session and preventing malicious traffic from being detected. Even the NSA has warned of the problems associated with TLS Inspection, issuing a cyber advisory on the subject.

This inability to see inside encrypted traffic traversing an organizations network is worrying, to say the least, with 87% of CIOs believing their security defenses are less effective because they cannot inspect encrypted network traffic for attacks, according to Venafi. As a new decade begins, organizations need to be wary of relying on traditional methods of detecting this new attack vector and not depend on decryption alone to solve the problem. If 2019 is any indication, then hidden malware isnt going anywhere.

Gartner predicts that over 70% of malware campaigns in 2020 will use some type of encryption. Whether this includes new strains of Emotet or Ryuk, or completely new threats, organizations need to be prepared.

In particular, they must look at alternative methods of protecting their networks and consider more modern solutions. Rather than rely on anti-malware scanners that are unable to see inside encrypted traffic or count on decryption to sort the bad data from the good, organizations should look at AI and machine learning techniques that analyze encrypted traffic at a metadata level. These methods dont require decryption, so as well as avoiding compliance issues by avoiding looking at traffic content, there are also no problems with latency or with navigating TLS 1.3.

This proactive and neater approach to malware detection will be an essential tool as encrypted malware becomes an even greater threat.

More:
Keeping Up With Encryption in 2020 - Security Boulevard