As organizations invite more mobile and IoT devices into their networks and adopt increasingly complex multi-cloud architectures, data and workflows are no longer confined to a static and highly secured segment of the network. Web and application-based traffic comprise a higher volume of total traffic, with much of that traffic including sensitive data or accessing information that was traditionally hidden deep in the data center. To accommodate this change, organizations are increasing their reliance on encryption, primarily secure sockets layer (SSL) and transport layer security (TLS), to protect their data in motion.
More encrypted traffic than ever
As a result, encrypted traffic has hit a new all-time threshold of over 72 percent of all network traffic. That’s a nearly 20 percent increase in just a single year, up from 55 percent in Q3 of 2017. There are many benefits to this strategy, the most important of which is that it allows data, applications, workflows, and transactions initiated by both employees and consumers to travel wherever business requirements demand. In turn, this enables our global transition to a digital economy.
While in many ways the growth of encryption is a good thing for security, higher encryption rates also present severe challenges to deep inspection of traffic to monitor for and detect threats. Because encryption is merely a tool, it can be used to protect any traffic from detection, whether good or malicious. Cybercriminals, for example, are very aware of the growth of encryption and use it to their advantage to obscure their presence and evade detection, whether delivering malware of exfiltrating stolen data. And as the volume and percentage of encrypted data continue to grow, these criminal tactics are increasingly likely to be able to hide in plain sight.
Few security devices can keep up
One reason why this is a growing concern and is about to hit a critical threshold is that inspecting encrypted traffic imposes critical performance limitations on nearly all firewall and IPS devices available on the market today. Generally speaking, examining encrypted traffic puts an enormous strain on a security device. Using ciphers to decrypt and inspect SSL/TLS traffic correctly is extremely CPU-intensive.
According to recent test results from NSS Labs, very few security devices can inspect encrypted data without severely impacting network performance. On average, the performance hit for deep packet inspection is 60 percent, connection rates dropped by an average of 92 percent and response time increased by a whopping 672 percent. Even more concerning, not all products were able to support the top 30 cipher suites either, meaning that some traffic that appeared to be analyzed wasn't being processed by some of the security devices at all.
Of course, these types of results render most traditional security devices nearly useless in today’s networks where encryption is the norm and performance is critical. It’s also why most security vendors literally don’t publish their SSL/TLS inspection numbers and why salespeople tend to avoid the issue when it comes up. As a result, much of today’s encrypted traffic is not being analyzed for malicious activity—making it an ideal mechanism for criminals to spread malware or exfiltrate data.
At the same time, enterprises must be aware of and concerned if they are not decrypting and inspecting SSL traffic, not just from untrusted sources, but from devices – especially IoT – that have been intentionally deployed inside the network.
Addressing the challenge
Here are a handful of suggestions to help organizations address this growing security concern:
Practice good security hygiene – Nearly every list of recommendations should start here. The reality is that most problems encountered in today's networks are the result of a failure to patch, upgrade or replace vulnerable devices, to check configurations for errors and to harden things like ports to prevent easy exploitation.
