Four Network Security Mistakes Bound to Bite You

Chances are many of our readers who lead SecOps teams are also among the 35 million anticipated Shark Week viewers this week. So we’ve taken a very important topic in the network security realm — visibility — and paired it with some heart-pumping shark attack facts. Read on to see the parallels.

Just as sharks linger off the Florida coast, encrypted threats are lurking in network traffic. And as the volume of transport layer security (TLS) encrypted traffic rises exponentially, organizations become even more vulnerable to attacks. Ouch.

Also cringeworthy is the spike in shark sightings each summer. If you’re one of the 35 million viewers planning to partake in the cultural feeding frenzy that is Shark Week, I offer you a primer. Here we marry our shark appreciation with some serious discussion around the following four network security mistakes bound to bite you:

1. Letting Familiarity Fool You Into Complacency

Most shark attacks occur less than 100 feet from the shore, says National Geographic. But even when in close proximity, for example, just a few feet away from these swimmers at Daytona Beach, they’re really hard to see. The same can be said for the network. It’s a familiar environment, yet more than half of malware is now hiding right beneath your nose in encrypted traffic.

Pro tip: Treat encrypted traffic as an attack vector. Make sure you can quickly expose encrypted attacks, hidden command and control channels, malware and unauthorized data exfiltration exploits. 

2. Misjudging the Effectiveness of Your Gear

It’s important to wear a hat and lather on the SPF at the beach, but while you’re focused on blocking sun, let’s not forget you could still be acting as a shark magnet, according to this researcher, depending on your tattoos, nail polish and jewelry. Leaving pockets of risk is much like the way operations teams want visibility into encrypted traffic for analysis, but the security and analytics tools deployed specifically for this purpose instead invite trouble when they struggle to keep up with decryption. 

Pro tip: Before deploying any SSL decryption solution, be aware of the total volume of network traffic and how much of it is SSL/TLS encrypted. Know how and where traffic is traversing the network. For an SSL/TLS solution to work effectively, it needs to see both directions of traffic. Asymmetric traffic can cause incomplete decryption if all traffic is not combined and fed to the solution.

3. Ignoring Cloud Considerations

From dusk until dawn and when dipping into murky waters, clouded conditions carry an increased risk of shark encounters. Security leaders are navigating similar visibility challenges that come as a result of enterprises deploying more and more software to private and public clouds and making wider use of SaaS applications.

Pro tip: Remember to establish a clear line of sight and to secure all data-in-motion, not just across the enterprise, but also cloud environments as well. Don’t get caught like a shark out of water, which can happen when you can’t see where and how network data is increasing and you end up caught in a period of catch-up that can hurt business transformation projects like cloud adoption. Effective network visibility helps scale the network — and the business.

4. In the Event of Attack, not Knowing the Response Plan

Shark Week programming will likely strike fear, but will you walk away knowing what to do if faced with an attack? (See here for advice). When it comes to cyber sharks, only 58 percent of organizations feel highly confident that they could detect an important security issue before it has significant impact.

Pro tip: Honestly appraise your threat detection and incident response tools and processes, and evaluate any architectural improvements you might need to make to stay a step ahead. Intentionally engineer your security strategy to overcome data and toolset silos to get information to the right place at the right time, and base your architecture on a deliberate attempt to identify, respond to and counter threats.

For more related reading, check out this post by Gigamon CEO Paul Hooper on why sight and security are inseparable to IT and the one true source of truth will always be the network. This post originally appeared in Dark Reading.

No security posture — or open-water swim — is absolutely safe. But taking appropriate safety measures, as outlined above, can go a long way toward a reliable and maintainable security infrastructure. Bottom line: When it comes to swimming with sharks, visibility matters.

CONTINUE THE DISCUSSION

People are talking about this in the Gigamon Community’s Security group.

Share your thoughts today