Heartbleed ahead for enterprises?

Palo Alto Networks is warning that the full effects of the Heartbleed vulnerability may not yet have been felt, despite many believing Heartbleed is behind us.

And the company is warning that while the visible impact of Heartbleed has been on web applications such as Google, Dropbox, Facebook, Yahoo!, online banking and other vulnerable targets on the web – which have now been updated – it’s enterprises which are now at risk.

Gavin Coulthard, Palo Alto Networks manager systems engineering Australia/New Zealand, says the web impact already seen was ‘only the tip of the iceberg’.

“The Heartbleed vulnerability puts the tools that were once reserved for truly advanced cyber criminals into the hands of the average attacker, notably the ability to breach organisations and move laterally within them.”

A recent Palo Alto Networks Application Usage and Threat Report reveals that in Asia Pacific, 32% of applications are capable of using SSL. The top 10 sub-categories in the enterprise that can use SSL include file-sharing, instant messaging, social networking, photo-video, internet conferencing, remote access, internet-utility, management, email and general business.

“Most enterprises of even moderate size do not have a good handle on what services they are running internally using SSL encryption, much less those that the end-users have brought into the network,” says Coulthard. “More importantly, they don’t inspect applications for malicious activity.

“SSL use is a much bigger problem that it was even a year ago, because if organisations don’t know how many applications running on the network use SSL, they also don’t know how many of those applications use OpenSSL, which may directly or indirectly expose the organisation,” he adds.

“Proofs-of-concept that take advantage of Heartbleed are no doubt in the works.

“It is only a matter of time before an automated internal scanner is developed that finds vulnerable services on the local network and exploits them with a single click. The challenges that presents to organisations is significant. For example, once you know how many internal applications may be using OpenSSL, how difficult will it be to update them? If it is a business-critical application, the effort is not small.”

Coulthard says organisations must determine which applications are capable of using SSL – both business applications and those in use by employees – then determine which of them use OpenSSL.

“The primary risk to end user-introduced applications using OpenSSL is the endpoint. The secondary risk is what is on that endpoint machine in terms of company data. Knowing which applications are using SSL, who is using them, and what network resources the person has access to will let organisations gauge and then minimise their exposure.”

Follow Us
on Google+

Review: Sony Xperia Z2

NetGuide Smartphones are all about compromise these days. Fitting a hi-res screen, camera and huge battery into increasingly lighter handsets isn’t easy, and usually, something has to give.   Read More →

Review: LifeTrak C410 Fitness tracker

NetGuide The C410 is a fitness tracker first and a watch second. Because of this it not only tells the time, but also tracks almost everything a fitness nut would need to know.
Amongst the many stats tracked are Steps. Calories are measured too as are distances covered. There’s a sleep tracking function, plus heart rate monitoring.   Read More →

Android App Review: Writing Prompts

NetGuide Writing Prompts is one of those obviously-named apps that gives you exactly what the name suggests and nothing more. If you want some help getting started with your creative writing, then the Writing Prompts app might be able to help.   Read More →