Research: Clueless Enterprises Miss Certificate Breaches

This article was originally posted by IDG Connect on August 5, 2015 at: http://www.idgconnect.com/abstract/10251/research-clueless-enterprises-miss-certificate-breaches

Attacks on digital keys and certificates are very different to typical cyberattacks and are becoming increasingly common, leaving victims open to devastating security breaches.

With a compromised or stolen key, cyber criminals can impersonate, surveil, and monitor their targets, as well as decrypt traffic and impersonate websites, code, or administrators. Unsecured keys and certificates give attackers unrestricted access to their victim’s network, where they may go undetected for some time with trusted access, siphoning off confidential data to use for criminal ends.

In light of attacks such as Sony Pictures Entertainment last year, Venafi conducted a survey amongst IT security professionals to garner what they do to prevent breaches and establish greater trust online? Disturbingly, the data revealed that most IT professionals acknowledge they don’t know how to detect or remediate compromised cryptographic keys and digital certificates.

The survey results highlighted that 38% of respondents can’t, or don’t know how to, detect compromised keys and certificates, and 56% of the other respondents said they are using a combination of Next Generation Fire Walls (NGFW), anti-virus, Intrusion Defense Systems (IDS), Intrusion Prevention Systems (IPS), and sandboxes to find these types of attacks.

One area in which cybercriminals are taking advantage is through Secure Sockets Layer (SSL) encrypted traffic, which is rapidly gaining momentum in enterprises. According to market research company Gartner, 50% of all inbound and network attacks will use SSL/Transport Layer Security (TLS) by 2017. Attackers are aware that most security systems either trust SSL/TLS or don’t have access to keys to decrypt traffic and search out hidden risks. These security weaknesses create blind spots that subvert critical security controls.

Perturbingly, almost two-thirds (64%) of security professionals admitted that they are not able to respond quickly (within 24 hours) to attacks on keys, and most said it would take three or more days, or up to a week, to detect, diagnose, and replace keys that have been breached.

Following a breach, more than three-quarters (78%) of those surveyed said they would still only complete partial remediation which would leave them vulnerable to further attacks. When asked what their organisational strategy is to protect the online trust provided by keys and certificates, only 43% of respondents said that they use a key management system. Another 16% had no idea. A manual process was being used by 14%, whilst 22% placed the responsibility elsewhere in the enterprise.

The survey findings are concerning given the increase in attacks on internet trust and the major SSL/TLS and SSH key and certificate-related vulnerabilities we’ve seen over the past six months alone. From Heartbleed, ShellShock, POODLE, the Gogo man-in-the middle attacks, Lenovo’s Superfish vulnerability, FREAK and now the LogJam flaw, cybercriminals are all too aware of the vulnerabilities in unprotected keys and certificates and are using these weaknesses to carry out malicious acts.

Read the full article at: http://www.idgconnect.com/abstract/10251/research-clueless-enterprises-miss-certificate-breaches