RSA Survey of Nearly 850 IT Security Professionals Finds They Don’t Know How to Detect and Respond to Key and Certificate Vulnerabilities
Venafi, the Immune System for the Internet™ and the leading provider of Next Generation Trust Protection, today released the results of its 2015 RSA Conference survey, gathered from nearly 850 IT security professionals during the week of April 20th in San Francisco. The survey data reveals that most IT security professionals acknowledge they don’t know how to detect or remediate quickly from compromised cryptographic keys and digital certificates, the foundation of trust in our modern, digital world.
Attacks on keys and certificates are unlike other common attacks seen today. With a compromised or stolen key, attackers can impersonate, surveil, and monitor their organisational targets as well as decrypt traffic and impersonate websites, code, or administrators. Unsecured keys and certificates provide the attackers unrestricted access to the target’s networks and allow them to remain undetected for long periods of time with trusted status and access.
“The results of this survey are very concerning when you look at the uptick of attacks on trust and all of the major SSL/TLS and SSH key and certificate-related vulnerabilities revealed in the past six months alone. From Heartbleed, ShellShock and POODLE, the GoGo man-in-the-middle attacks and Lenovo’s Superfish vulnerability to FREAK and now the more recent LogJam flaw, cybercriminals know unprotected keys and certificates are vulnerable and will use them to carry out their malicious website spoofing and man-in-the-middle attacks,” said Kevin Bocek, vice president of security strategy and threat intelligence at Venafi.
The threatscape has changed and cyber criminals are able to take advantage of these new vulnerabilities because most security systems blindly trust keys and certificates. In the absence of an immune system for the internet, enterprises are unable to determine what is “self” and trusted in their networks and what is not and therefore dangerous. Not knowing what is trusted and “self” or how to detect or remediate from attacks on keys and certificates leaves organisations open to breach and compromise.
Venafi’s 2015 RSA survey revealed:
- Respondents are ill informed on how to remediate a Sony-like breach involving theft of keys and certificates. Following a breach, over three-quarters (78 percent) of those surveyed would still only complete partial remediation that would leave them vulnerable to further attacks. They would conduct standard practices such as re-imaging servers, reviewing logs, removing malware, installing patches and changing user passwords. However, only 8 percent indicated they would fully remediate against a Sony-like attack by replacing potentially compromised keys and certificates to prevent further access.
- IT security professionals simply don’t know how to protect keys and certificates and their organisations have no clear understanding or strategy for doing so. When asked what their organisational strategy is to protect the online trust provided by keys and certificates, only 43 percent of respondents reported that they are using a key management system. Another 16 percent have no idea at all, 14 percent said they are using a manual process to try and manage them, and 22 percent placed the responsibility elsewhere. Without a strategy and implemented security controls to protect keys and certificates, attackers can gain and maintain extensive access to the target’s networks and remain undetected for long periods of time with trusted status.
- Many IT security professionals can’t or don’t know how to detect compromised keys and certificates. The survey results show that 38 percent of respondents can’t or don’t know how to detect compromised keys and certificates and 56 percent of the other respondents said they use a combination of next generation firewalls, anti-virus, IDS/IPS and sandboxes to detect these types of attacks. Both groups leave themselves open to additional attacks. According to Gartner, 50 percent of all inbound and outbound network attacks will use SSL/TLS by 2017. Bad actors understand that most security systems either blindly trust SSL/TLS or lack access to the keys to decrypt traffic and find hidden threats. These shortcomings create blind spots and undermine critical security controls like sandbox threat protection, NGFW, IDS/IPS, and DLP.
- More than half of IT security professionals admit that they cannot quickly respond to an attack on SSH keys. Almost two-thirds (64 percent) of security professionals admit that they are not able to respond quickly (within 24 hours) and most said it would take 3 or more days, or up to a week, to detect, diagnose and replace keys on all hosts if breached. Cybercriminals are exploiting the lack of visibility and control over SSH keys, which are used to authenticate administrators, servers, and clouds. Because SSH keys never expire, cybercriminals and insiders alike gain almost permanent ownership of systems and networks by stealing SSH keys.
Added Bocek, “IT security professionals need to realize that keys and certificates establish trusted connections for virtually everything IP-enabled today. Just like the human immune system, when SSL/TLS and SSH keys are protected and used correctly, they identify webservers, software, mobile devices, applications and even security administrators as ’self’ and trusted and those that are misused should be identified as ‘other’ and replaced or blocked.”
“But keys and certificates are often blindly trusted, so cyber criminals use them to hide in encrypted traffic, spoof websites, deploy malware, and steal data. Ultimately, if what our survey data says is true, and IT security professionals can’t secure and protect keys and certificates and respond more quickly to attacks that use them, online trust will continue to diminish with grave consequences, especially to the economy which relies so heavily on online trust for commerce and mission-critical business activities,” concluded Bocek.
[su_box title=”About Venafi” style=”noise” box_color=”#0e0d0d”]
Venafi is the Immune System for the Internet™ and protects the foundation of all cybersecurity—cryptographic keys and digital certificates—so they can’t be misused by bad guys in attacks. In today’s connected world, cybercriminals want to gain trusted status and remain undetected, which makes keys and certificates a prime target. Unfortunately, most security systems blindly trust keys and certificates. Venafi patrols across the network, on devices, and behind the firewall, constantly assessing which SSL/TLS, SSH, WiFi, VPN and mobile keys and certificates are trusted, protecting those that should be trusted, and fixing or blocking those that are not.
As the market-leading cybersecurity company in Next Generation Trust Protection (NGTP) and a Gartner-recognized Cool Vendor, Venafi delivered the first Trust Protection Platform™ to protect keys and certificates and eliminate blind spots from threats hidden in encrypted traffic. As part of any enterprise infrastructure protection strategy, Venafi TrustAuthority™, Venafi TrustForce™, and Venafi TrustNet™ help organisations regain control over keys and certificates by establishing what is self and trusted on mobile devices, applications, virtual machines and network devices and out in the cloud. Venafi protects Any Key. Any Certificate. Anywhere™. From stopping certificate-based outages to enabling SSL inspection, Venafi creates an ever-evolving, intelligent response that protects your network, your business, and your brand. Venafi Threat Center also provides primary research and threat intelligence for attacks on keys and certificates.
Venafi customers are among the world’s most demanding, security-conscious Global 5000 organisations in financial services, retail, insurance, healthcare, telecommunications, aerospace, manufacturing, and high tech. Venafi is backed by top-tier venture capital funds, including Foundation Capital, Pelion Venture Partners, and Origin Partners. For more information, visit www.venafi.com.[/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.