Heartbleed ahead for enterprises?

Palo Alto Networks is warning that the full effects of the Heartbleed vulnerability may not yet have been felt, despite many believing Heartbleed is behind us.

And the company is warning that while the visible impact of Heartbleed has been on web applications such as Google, Dropbox, Facebook, Yahoo!, online banking and other vulnerable targets on the web – which have now been updated – it’s enterprises which are now at risk.

Gavin Coulthard, Palo Alto Networks manager systems engineering Australia/New Zealand, says the web impact already seen was ‘only the tip of the iceberg’.

“The Heartbleed vulnerability puts the tools that were once reserved for truly advanced cyber criminals into the hands of the average attacker, notably the ability to breach organisations and move laterally within them.”

A recent Palo Alto Networks Application Usage and Threat Report reveals that in Asia Pacific, 32% of applications are capable of using SSL. The top 10 sub-categories in the enterprise that can use SSL include file-sharing, instant messaging, social networking, photo-video, internet conferencing, remote access, internet-utility, management, email and general business.

“Most enterprises of even moderate size do not have a good handle on what services they are running internally using SSL encryption, much less those that the end-users have brought into the network,” says Coulthard. “More importantly, they don’t inspect applications for malicious activity.

“SSL use is a much bigger problem that it was even a year ago, because if organisations don’t know how many applications running on the network use SSL, they also don’t know how many of those applications use OpenSSL, which may directly or indirectly expose the organisation,” he adds.

“Proofs-of-concept that take advantage of Heartbleed are no doubt in the works.

“It is only a matter of time before an automated internal scanner is developed that finds vulnerable services on the local network and exploits them with a single click. The challenges that presents to organisations is significant. For example, once you know how many internal applications may be using OpenSSL, how difficult will it be to update them? If it is a business-critical application, the effort is not small.”

Coulthard says organisations must determine which applications are capable of using SSL – both business applications and those in use by employees – then determine which of them use OpenSSL.

“The primary risk to end user-introduced applications using OpenSSL is the endpoint. The secondary risk is what is on that endpoint machine in terms of company data. Knowing which applications are using SSL, who is using them, and what network resources the person has access to will let organisations gauge and then minimise their exposure.”

Follow Us
on Google+
Sponsored

Hilton Auckland

As more and more conferences and events arrive in New Zealand, the opportunity to gain knowledge and build networks becomes better every day. Conferences can be hard work, and there’s nothing like retiring to a nice hotel room at the end of the day to relax and rest. But how do you turn a night in a hotel room into a lesson in building brand loyalty?   Read More →

Android App Review: Vimeo

NetGuide I review a lot of apps that, for one reason or another, aren’t that good. But it’s rare to find one that’s actually irredeemably broken. Video sharing website Vimeo’s app, however, is closer than it should be for an app with such obvious potential.   Read More →

Review: Samsung Gear S

NetGuide It takes something pretty special to stand out from the crowd in the smart wearable space. With new smartwatches and bands launching on a weekly basis, there’s lots of noise and plenty of confusion.   Read More →