The Cyber-Breach Perfect Storm: How 'Internal Cryptographic Segmentation' Can Keep Companies Out of the Hacking Headlines
The costs are still being tallied, but it’s clear that hack attacks no longer are a mere nuisance or a relatively trivial case of “cyber graffiti” like in the past. The costs of cleanup in only one of the retail breaches last year could easily top half a billion dollars. In another case, a judge has cleared the way for banks to sue a retailer for negligence for letting a breach take place. Hack attacks now have a direct impact on the bottom line.
Why is this Happening now?
The Cyber-Breach Perfect Storm resulted from the convergence of three long-term technology trends.
Trend 1: Digitization
After decades of investment in new IT technologies, enterprises in a wide range of sectors have converted all manners of critical information to digitized form, and placed this data on networks. We now have now digitized healthcare data, credit card information, financial transactions, proprietary secrets, system control data, student records and much more. It’s easy to store or process this sensitive data on a network or in the Cloud and share it with colleagues or partners. Digitizing has brought amazing advantages to the business with increased efficiency, mobility, and a major boost to productivity.
But then there's the dark side. Easy sharing also means easy sharing with everybody, good or bad. Having this information digitized means it can also be accessed by remote attackers or unauthorized insiders.
Trend 2: Hacking incentives
In the old days, hackers basically committed what amounted to vandalism. The typical hack was to put graffiti on a website or take down an e-commerce server for a few hours. It was embarrassing and annoying, but had relatively minor impact on the business as a whole.
Now modestly skilled hackers have access to everything, mission-critical data that they can hold hostage, or use for identity theft, or sell on the black market. There’s tremendous financial incentive for hackers today. For example, experts estimated that hackers in only one of the recent retail breaches made off with credit card numbers worth more than $1 billion on the black market.
“The Cyber-Breach Perfect Storm resulted from the convergence of three long-term technology trends”
Trend 3: Lagging security
The typical IT security architecture relies on the quaint notion that a firewalled perimeter can keep the bad guys out and that the enterprise has a “trusted” internal network. The idea is that your security is “crunchy” on the outside, with strong firewalls, but “soft” on the inside, with internal networks easily navigable for the sake of application access and performance.
As Target, Home Depot, Sony and countless other data breach victims have shown, this belief is a dangerous fantasy .
Again and again, hackers compromised firewalls, gained access to an internal system, and then had complete freedom to access sensitive data on other systems in the internal networks.
Plugging this security hole is actually really straightforward: encrypt sensitive data traffic everywhere and use cryptographic segmentation to isolate sensitive applications, even on internal networks. This requires adopting a “no trust” security model.
Staying Out of the Hacking Headlines
Security technology analysts have been advocating a “no trust” model for years, advising IT managers to never assume the internal network is to be trusted.
This means IT needs to encrypt the traffic of all sensitive applications even when they are hosted internally. Assume there is malware already in the LAN that could affect these applications. Assume the network perimeter has already been breached. Assume that hackers can remotely access a given system. Assume that logical network segmentation controls, such as VLANs and ACLs, are already compromised, which is trivially easy for a script-kiddie hacker.
In late 2014, Certes Networks commissioned Spiceworks to conduct a global survey of IT decision-makers to understand their challenges with protecting networked applications. The survey found that 51 percent of IT managers want to use encryption to protect sensitive application traffic but are unable to do so because of security product shortcomings.
First, more than 75 percent of IT managers have to use two or more different forms of encryption to secure a networked application from end-to-end across its entire path. More than a third reported having to use three or more forms of encryption.
This fragmentation of data traffic encryption leads to configuration errors, difficulty with ensuring end-to-end protection and, frankly, too many wasted hours manually configuring arcane encryption policies on multiple systems.
Second, a little more than a third said they cannot use cryptographic segmentation because of reduced performance of firewalls and network devices when they are used to encrypt traffic.
Performance of typical firewalls and network devices will drop by 75 percent or more when encryption is turned on, mostly because of the processing toll on the system. Some vendors even brag in data sheets that device performance is “only” cut in half when encryption is on. This is like you bought a sports car that can go 160 miles an hour. But if you put on your seatbelt, it can only go 40 miles an hour. Your vendors are saying: “You can be fast. Or you can be safe. But you can’t be fast and safe.”
The good news is that cryptographic segmentation, the use of encryption on internal networks, is entirely possible and available today, thanks to products that separate the encryption of data traffic from the network functions themselves. Thousands of banks, governments, schools, hospitals and others are using cryptographic segmentation today for sensitive traffic over all types of networks. These companies generally fly under the security news radar because they are not being hacked.
In the end, enterprises modernizing their security architectures will need to embrace the “no trust” model and put in place strong encryption controls to protect sensitive applications, even on their internal networks. While nothing is a guarantee of security, cryptographic segmentation can go a long way toward keeping an enterprise out of the hacking headlines.