Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

Increased encryption a double-edged sword

Maria Korolov | May 5, 2015
While there isn't much the DHS and the NSA can do to stem the spread of encryption, enterprises can take steps to ensure that encryption is benefiting the organization and not their enemies.

security encryption key

The Department of Homeland Security may be complaining that encryption is interfering with their attempts to eavesdrop on criminals and terrorists — but they're not the only ones inconvenienced.

Enterprise security may also be hampered by ubiquitous encryption because it makes it harder to spot when sensitive data is leaving the company, or when malware is communicating with its command and control servers.

Cloud-based email services, online storage sites, and other cloud application providers have already begun encrypting traffic. Even social networks are encrypting traffic. And, recently, Firefox experimented with expanding encryption to more and more of the Web.

According to a recent report from Dell, the amount of encrypted traffic through corporate firewalls has doubled over the past year and now accounts for 60 percent of all communications.

But not all corporations are prepared for the day when all traffic in and out of their networks is encrypted.

Fortunately, while there isn't much the DHS and the NSA can do to stem the spread of encryption, there are steps that enterprises can take to ensure that encryption is benefiting them and not their enemies.

The latest smart firewalls can decrypt and monitor both incoming and outgoing traffic, helping companies with both data loss prevention and malware control.

Time for firewall upgrades
Ubiquitous encryption will most affect enterprises running older firewalls and data loss prevention solutions.

"If browsers start encrypting everything, it will make spotting malicious traffic harder," said Jeremy Scott, senior research analyst at Solutionary.

Security analysts need to be able to see traffic in order to see whether sensitive data is being exfiltrated or malware is being downloaded.

"By protecting the traffic from prying eyes, it also prevents detection of malicious activity by watchful eyes," said Scott.

Jeremy Scott, senior research analyst at Solutionary

Legacy systems are already effectively blind to 60 percent of all traffic, said John Gordineer, director of product marketing for network security at Dell.

"This is definitely a big issue," said John Pirc, chief strategy officer and co-founder at security vendor Bricata.

However, solutions are already on the market, in the form of web proxies and other security devices that provide a decryption method that allows the security appliance to inspect encrypted traffic.

In the past, systems that decrypted and analyzed traffic may have had a performance impact on communications, Pirc said.

"You need to buy dedicated devices that do SSL offload," he said.

Another option is cloud-based Web application firewalls, though these require that enterprises give up their SSL keys to an outside vendor.

Rogue encryption a big red flag
But a proxy can't always decrypt all traffic in and out of a company.


1  2  3  Next Page 

Sign up for CIO Asia eNewsletters.