TLS 1.3: Expert Advice to Modernize Your Security and Decryption Practices
1 like299 views
This document summarizes a webinar on TLS 1.3 and how it will impact network security and decryption practices. TLS 1.3 enables improved privacy and security but reduces visibility for security teams. The webinar speakers were Paula Musich, a security research director, and Scott Register from Ixia, who discussed the challenges networks will face in decrypting traffic while maintaining performance. A survey found that while adoption of TLS 1.3 is increasing rapidly, many organizations are unprepared for the impact on their security architectures and monitoring capabilities.
TLS 1.3: Expert Advice to Modernize Your Security and Decryption Practices
- 1. Paula Musich Research Director Enterprise Management Associates TLS 1.3: Expert Advice to Modernize Your Security and Decryption Practices IT & DATA MANAGEMENT RESEARCH, INDUSTRY ANALYSIS & CONSULTING Scott Register VP, Product Management Ixia, a Keysight business
- 2. Watch On-Demand Webinar • TLS 1.3: Expert Advice to Modernize Your Security and Decryption Practices On-Demand webinar is available here: http://info.enterprisemanagement.com/tls-1.3-expert-advice-to- modernize-your-security-and-decryption-practices-webinar-ws • Check out upcoming webinars from EMA here: http://www.enterprisemanagement.com/freeResearch
- 3. IT & DATA MANAGEMENT RESEARCH, INDUSTRY ANALYSIS & CONSULTING3 © 2019 Enterprise Management Associates Today’s Speakers Paula Musich, Research Director, EMA Paula brings over 30 years of experience covering the IT security and networking technology markets. She has been an IT security analyst for over nine years, most recently as a research director at NSS Labs, and earlier as principal analyst for enterprise security for Current Analysis. Scott Register, VP, Product Management, Ixia, a Keysight business Scott has more than 15 years of experience leading product management operations for global technology companies. He holds B.S. and M.S. degrees in computer science from Georgia Institute of Technology and also served as a member of the research faculty.
- 4. IT & DATA MANAGEMENT RESEARCH, INDUSTRY ANALYSIS & CONSULTING IT & DATA MANAGEMENT RESEARCH, INDUSTRY ANALYSIS & CONSULTING Paula Musich Research Director Enterprise Management Associates TLS 1.3: Expert Advice to Modernize Your Security and Decryption Practices
- 5. Introduction and Methodology TLS 1.3 Finally Debuts • 10 years in the making • The benefits: • Reduced latency • End-to-end privacy • Better end-user experience • The downsides • Lost visibility for security and troubleshooting Methodology • Surveyed 249 IT pros involved in security and IT management • 67% security is primary role • 40% IT Director/Manager/Supervisor • 15% CIO/CTO/VP IT • 12% CSO/CISO/IT Security Director 5 © 2019 Enterprise Management Associates
- 6. Current State of Encryption in the Enterprise
- 7. Heightened visibility concerns, but no alarm bells over potentially missed encrypted malware Slide 7© 2019 Enterprise Management Associates, Inc. As more network traffic is encrypted, how concerned is your organization that your existing security monitoring practices/technologies will miss malware hidden in encrypted files? 6% 36% 23% 17% 18% Not at all concerned Somewhat concerned Concerned Very concerned Extremely concerned
- 8. How Much Traffic Decrypted for Analysis Varies by Organization Size TLS 1.3 6% 11% 38% 35% 9% 0% 0% 43% 50% 7% 3% 11% 44% 35% 6% 13% 14% 28% 33% 13% 28% 10% 14% 28% 21% Don’t know 76%-100% 51%-75% 26%-50% 0%-25% VL Enterprise Enterprise (All) Midsized SMB Total
- 9. Current Decryption Methods Slide 9© 2019 Enterprise Management Associates, Inc. 25% 23% 18% 16% 15% 3% 1% 0% 5% 10% 15% 20% 25% 30% Decrypt using a web proxy Decrypt in an inline security device Decrypt in an out-of-band security device Decrypt in inline load balancer Decrypt using an inline-dedicated decryption device We are not currently decrypting any of our traffic Other (Please describe)
- 10. Where Encryption is Enabled TLS 1.3 34% 55% 58% 71% 76% For internally-developed applications For web services For email services Within the data center Within the enterprise network
- 11. Where, if at all, does your organization intend to implement encryption over the following timeframes? 4% 3% 5% 11% 34% 44% 4% 2% 4% 14% 30% 45% 7% 3% 3% 17% 29% 40% 4% 2% 2% 14% 29% 49% 6% 2% 4% 10% 29% 50% We don’t intend to implement additional encryption 2 years or more 19 to 24 months 13 to 18 months 7 to 12 months 0 to 6 months Total For internally-developed applications For web services For email services Within the enterprise network Within the data center
- 12. Drivers and Concerns Behind TLS 1.3 Enablement
- 13. 13 © 2019 Enterprise Management Associates Yes, There are Concerns… Security and Operational Concerns for Enabling TLS 1.3 7% 37% 34% 22% 9% 30% 40% 21% We are not at all concerned We are only slightly concerned We have some concerns We have significant concerns Operational concerns Security concerns
- 14. 14 © 2019 Enterprise Management Associates Enablement is Moving Full Steam Ahead The big surprise is that enablement/adoption of TLS 1.3 is moving quickly for inbound connections and internal traffic 2% 32% 41% 17% 6% 3% 40% 34% 14% 6% Not planning to enable TLS 1.3 at this time Already underway Within 6 months 7-12 months 13-18 months Inbound connections Internal traffic
- 15. Top Motivations for Enabling TLS 1.3 Slide 15© 2019 Enterprise Management Associates, Inc. 67% 73% 44% 55% 52% 51% 50% Very Important Improved privacy for end-to-end security Improved data security Decreased latency/TLS session setup time Better user experience To be seen as following industry standards Industry moving away from earlier versions To meet the supplier requirements of our customers
- 16. Keeping up with Top Web Server Vendors Comes at a Cost for Internal Web Application Development Slide 16© 2019 Enterprise Management Associates, Inc. Top Three Concerns on Internal Web Application Development Driven by Web Server Vendor Adoption of TLS 1.3 21% 21% 21% 17% 11% 7% 2% Increase development lifecycle time/cost Increase operations lifecycle time/cost Increase development training time/costs Increase operations training time/cost Impact customers' access to goods and services Impact customer satisfaction No significant impact % Total Mentions
- 17. How much will it cost to adapt security architectures to TLS 1.3? TLS 1.3 4% 13% 27% 35% 17% 4% 0% 17% 25% 42% 17% 0% 2% 10% 25% 42% 18% 4% 10% 16% 30% 22% 16% 5% 29% 10% 24% 10% 19% 10% Over $1 Million $501,000 to $1 Million $251,000 to $500,000 $101,000 to $250,000 $51,000 to $100,000 Less than $50,000 VL Enterprise Enterprise (All) Midsized SMB Total
- 18. Strategies for Regaining Visibility Slide 18© 2019 Enterprise Management Associates, Inc. How does your organization intend to address the security visibility issue TLS 1.3 caused? 26% 22% 21% 21% 9% 0% 5% 10% 15% 20% 25% 30% Maintain existing firewalls at earlier versions of TLS for as long as possible Look for inline alternatives that enable decryption and inspection by existing security controls without exacting a significant performance penalty Replace existing stateful inspection firewalls with proxy-based firewalls Enable decryption and re-encryption on existing inline security devices and hope that it doesn't add too much latency, complexity, or security vulnerability Look for out-of-band decryption solutions that enable decryption and inspection without exacting a significant performance penalty
- 19. How Different-Sized Organizations Intend to Approach TLS 1.3 Enablement Slide 19© 2019 Enterprise Management Associates, Inc. 46% 8% 31% 15% 23% 40% 33% 3% 24% 12% 53% 7% Enable for all traffic at once Enable for critical traffic only Enable for critical traffic first, then other traffic if convenient Enable only where required for regulatory compliance SMB Midsized Large Enterprise
- 20. Key Findings Summary • The spreading use of encryption in the enterprise is growing rapidly, but introduces some concerns over the ability to inspect for malware hidden in encrypted files • TLS 1.3 enablement is happening much faster than expected • There is an apparent disconnect between enablement plans and what’s required to achieve that while maintaining visibility for troubleshooting and security monitoring • Greater education is required to bridge that gap
- 21. 21© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | 21© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | INTRODUCTION TO TLS1.3
- 22. 22© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | ENCRYPTION: THE DOUBLE-EDGED SWORD • Data visibility is a problem when encrypted – many devices cannot inspect encrypted data • Encryption and TLS 1.3 are a good thing • You will be forced to change your network • You must set the right expectations for privacy, security and visibility Expect improved privacy* Expect improved data security* Expect improved user experience* *Source = Report Summary: TLS 1.3 Adoption In The Enterprise by EMA, 2019 67% 73% 55%
- 23. 23© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | Version Released Deprecated SSL1.0 1995 (Oops) Immediately SSL2.0 1995 2011 SSL3.0 1996 2015 TLS1.0 1999 Upcoming TLS1.1 2006 Upcoming TLS1.2 2008 TLS1.3 2018 • Encryption is used to secure connections between web browsers and servers • Transport Layer Security (TLS) is the new term for Secure Sockets Layer (SSL), but the two are often lumped together as “SSL” • TLS1.3 is the newest encryption standard • Improves privacy • Removes old less-secure algorithms • Big changes for many IT teams • Decreases setup latency SSL ENCRYPTION: A QUICK OVERVIEW
- 24. 24© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | Static Keys Ephemeral Keys One for each client/server pair Session Key New key every session If you have session key, you can read all sessions Forward secrecy Having the key for one session doesn’t let you see others OK Privacy Much better Straightforward Legitimate monitoring Problematic Can listen passively How to monitor? Must participate in session Only option up to TLS1.1 What TLS versions? Optional in TLS1.2 Mandatory in TLS1.3 STATIC VS. EPHEMERAL KEYS “Session keys” are used to encrypt data in transit. Older standards used the same “static” key every time for a given client/server. TLS1.3 requires “ephemeral” keys, new every time. The Good, The Bad, The Ugly
- 25. 25© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | Monitoring ephemeral key TLS/SSL • Must be inline • Must be an active part of the SSL connection – a “proxy” • Adds some latency / potential failure point • Clients must trust SSL inspection device Monitoring static key TLS/SSL • Can attach to a Tap or SPAN port • Stream directly to disk and decrypt later • No impact on original encrypted connection • Requires monitoring device to have a copy of server’s encryption keys MONITORING WILL BE VERY DIFFERENT WITH TLS1.3 Major Redesign Required
- 26. 26© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | • Common to have multiple layers of security – firewall, IPS, DLP, etc. • Bad idea to have each of them do independent encrypt/decrypt • Much better to have a single SSL proxy provide “decrypt once, inspect many” service • Dedicated SSL appliance or Network Packet broker feature SSL PROXIES AND DEFENSE IN DEPTH
- 27. 27© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | DEPLOYMENT OPTION #1 – APPLIANCE-BASED SSL • NPBs allow for distribution of encrypted data to decryption devices and then the distribution of the now unencrypted data to various tools (NGFW, IPS, DLP, etc.) Firewall Switch ServersBypass Switch Network Packet Broker Encrypted traffic SSL Decrypt IPS Other tools Deployment Scenario: Inline
- 28. 28© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | DEPLOYMENT SCENARIO #2 – NPB USING INTEGRATED SSL • SSL inspection generates a significant performance overhead on security tools • An NPB with integrated SSL/TLS decryption capability offloads this burden without impact Firewall Switch ServersBypass Switch Encrypted traffic Network Packet Broker SSL Decrypt IPS Other toolsDeployment Scenario: Inline
- 29. 29© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | • Hardware and software solutions for Passive SSL monitoring (pre-1.3) • High-performance options for Active SSL monitoring • Dedicated hardware acceleration • Integrated into industry-leading Vision ONE network packet broker and bypass switches • Point-and-click UI for management • Data Masking, NetFlow, Load Balancing, and other great features built-in • Test solutions for validating TLS1.3 performance and compliance IXIA IS HERE TO HELP We have a range of deployment and performance options
- 30. 30© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. | DOWNLOAD FREE WHITEPAPER https://www.ixiacom.com/resources/report-summary-tls-13-adoption-enterprise
- 31. 31© 2019 KEYSIGHT AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED. |