Palo Alto Networks Application Usage and Threat Report reveals 32 per cent of applications are capable of using SSL
The visible impact of Heartbleed has been on web applications, such as Yahoo!, Google, Dropbox, Facebook, online banking, and the thousands of other vulnerable targets on the web. These are of huge impact, but those sites have been updated and the world has moved on, believing Heartbleed is behind us.
Gavin Coulthard, Manager Systems Engineering Australia/New Zealand for Palo Alto Networks, said, “For security professionals and organisations this is only the tip of the iceberg. The Heartbleed vulnerability puts the tools that were once reserved for truly advanced cyber criminals into the hands of the average attacker, notably, the ability to breach organisations and move laterally within them.
“Most enterprises of even moderate size do not have a good handle on what services they are running internally using SSL encryption, much less those that the end-users have brought into the network. More importantly, they don’t inspect applications for malicious activity.”
The Palo Alto Networks Application Usage and Threat Report provides the industry’s most detailed assessment of the relationship between advanced cyber threats and the applications running on enterprise networks worldwide. In APAC, the survey revealed that 32 per cent of applications are capable of using SSL. The top ten sub-categories in the enterprise that can use SSL include file-sharing, instant messaging, social networking, photo-video, internet conferencing, remote access, internet-utility, management, email and general business.
Gavin Coulthard said, “SSL use is a much bigger problem than it was even a year ago, because if organisations don’t know how many applications running on the network use SSL, they also don’t know how many of those applications use OpenSSL, which may directly or indirectly expose the organisation.
“Proofs-of-concept that take advantage of Heartbleed are no doubt in the works. It is only a matter of time before an automated internal scanner is developed that finds vulnerable services on the local network and exploits them with a single click. The challenges that presents to organisations is significant. For example, once you know how many internal applications may be using OpenSSL, how difficult will it be to update them? If it is a business-critical application, the effort is not small.
“Organisations must determine which applications are capable of using SSL, both the business applications and those in use by employees, then determine which of them use OpenSSL. The primary risk to end user-introduced applications using OpenSSL is the endpoint. The secondary risk is what is on that endpoint machine in terms of company data. Knowing which applications are using SSL, who is using them, and what network resources the person has access to will let organisations gauge and then minimise their exposure.”
