FeatureEncryption is growing at a steady rate. This term that was once associated primarily with clandestine cyber operations has now gone mainstream owing to the popularity of consumer messaging applications such as WhatsApp and Signal. Highlighting the importance of this technology in a cloud-first world, popular collaboration services including Zoom and Microsoft Teams have also incorporated this security feature. And while the technique is undoubtedly beneficial, it can act as a double-edged sword.
Encryption can be used by hackers to exfiltrate data or to conceal malware delivery. Moreover, it can lead to a loss of visibility over the network, increasing the risk of malicious activity going undetected. It also reduces the administrators ability to monitor and optimise performance on a per-app or per-user basis.
Encryption has become the de-facto standard because it protects data in all states. This includes during transit which is when data is at its most vulnerable. Without encryption, cybercriminals can simply capture network traffic as they see it on the move. On the other hand, encoding the information places it in a black box, effectively making it unfindable and untouchable. In this way, encryption provides peace of mind for organisations.
Encryption is increasingly being used by hackers to disguise data exfiltration. This is because it enables them to sneak sensitive information – such as login credentials or financial data – by the companies’ security sensors. After all, IT Will not be alerted to an attack if they don’t have visibility over the contents of the network traffic.
Encryption has become the de-facto standard because it protects data in all states.
The lack of visibility creates challenges in the performance realm as well, as even for the authorised movement of data by employees, the business can see only the opaque transfer of information but not critical performance metrics. Without insight into protocol level metrics of how smoothly the data is moving, or not moving, IT teams can’t identify and resolve problems.
It is clear that the drawbacks of encoding centre around visibility. To thrive in a world where encryption is essential therefore, companies need to focus on achieving the same level of visibility and performance management over encrypted applications and network traffic as they’ve historically had for un-encrypted traffic. This is possible by investing in solutions that have been specifically designed to provide enhanced insight into encrypted network traffic.
Such solutions offer numerous benefits. Firstly, they empower operators to see if an application or network performance is slow and needs optimising to maintain user productivity. Secondly, they give them the ability to track, report, and validate the integrity of SSL, TLS certificates. This is a fundamental process for guaranteeing that critical encryption technology is properly deployed and are up-to-date, so that key data is not exposed to malicious actors.
Invest in solutions that have been specifically designed to provide enhanced insight into encrypted network traffic
It also means IT teams can pick out anomalous activity – such as an expired certificate being used, or unusual or weak cyphers – which may indicate a hackers’ presence. Furthermore, an awareness of the existence of encrypted channels can be powerful in itself. Although operators cannot see the content, they can dig in at either side to establish why the channel exists and if it may be for nefarious reasons.
It is paramount for companies to adopt solutions focused on regaining visibility. With these tools in place, they can reap the benefits encoding provides, while mitigating against any risks, in order to maintain strong company performance at a critical stage in the business environment.
Companies need to achieve same level of visibility over encrypted applications and network traffic as they have historically had for un-encrypted traffic.
