The biggest web threats to your managed networks

While encryption technologies have been key tools for ensuring web traffic stays private and secure, cybercriminals are also using encryption to hide malware and execute web-based attacks. Inspecting encrypted traffic is www.mcafee/activate more critical than ever before to keep modern business mcafee.com/activate product key networks secure. Yet, detecting suspicious web traffic for malicious content www.mcafee.com/activate download is not as straightforward as it seems.

First, networks have evolved to support new ways of working. That means security operations are much more complex today www.mcafee.com/activate . Employees are using a mix of personal and company-issued devices, connecting to networks from multiple locations. At the same time, small www.mcafee.com/activate product key and mid-size businesses (SMBs) may be in various stages of cloud-enabling their operations — and security measures may not be keeping pace www.mcafee/activate. Managed service providers (MSPs) and managed security service providers (MSSPs) may be dealing with a range of traditional, on-premise security appliances that simply aren’t effective against encrypted web threat

Next, in order to see inside encrypted data flows, traffic is decrypted as it enters and exits networks, then typically scanned for threats, and re-encrypted. You can imagine the costs and network performance mcafee.com/activate product key considerations with the sheer amount of data that needs to be processed for growing, modern workforces. 

Bandwidth and latency are key issues. In fact, latency caused by some security appliances that are designed to inspect traffic and protect networks www.mcafee.com/activate can be so severe that businesses may www.mcafee.com/activate product key turn off web traffic inspection www.mcafee/activate features entirely. According to Gartner it’s turned off in 90% of unified threat management (UTM) appliances. 

Even worse, when faced with performance  www.mcafee.com/activate download impact or more costs and complexity, some companies may choose not to deploy any services to inspect encrypted web traffic.

The reality is, for deep inspection of encrypted traffic, MSPs and MSSPs need advanced cloud-based security strategies that won’t impact performance for SMB customers who rely on the cloud — and won’t create new maintenance mcafee.com/activate product key headaches and added costs.

All of these factors create gaps in protection www.mcafee.com/activate product key, increase the chances of malicious encrypted web traffic bypassing your security defenses www.mcafee.com/activate, and fuel a massive volume of successful encrypted web attacks.

Iwhite paper, we look at the challenges with encrypted web traffic inspection, the types of attacks that are growing due to lack www.mcafee/activate of realistic inspection techniques, and modern security strategies to help MSPs and MSSPs respond with a smart defense.

Understanding the top threats to your customer’s web traffic

One thing is certain, if you ever question the need for inspecting encrypted traffic, one look at the web attacks gaining traction today www.mcafee.com/activate download may change www.mcafee.com/activate product key your mind www.mcafee.com/activate.

Here are just a few examples:

• Zero day: Zero day malware orviruses exploit a potentially serious software security weakness that a vendor or developer may be unaware of. In this case, it can execute its damage until a patch is developed and deployed for mcafee.com/activate product key the vulnerability. A zero day attack is especially dangerous because only the attacker is aware of its existence and it can go undetected by IT teams.
• Reductor: A new malware strain, called Reductor, enables attackers to manipulate Hypertext Transfer Protocol Secure (HTTPS) traffic by compromising a browser’s random numbers generator. This makes the encryption process unpredictable www.mcafee.com/activate, enabling attackers www.mcafee.com/activate product key to spy on all information and actions carried out by the web browser. Researchers noted the following ‘alarming’
  • It compromises encrypted Transport Layer Security (TLS) traffic.
  • It manipulates digital traffic and marks outbound TLS traffic with unique identifiers.
  • It infects the browser itself.
    
  • It compromises the random number generator, enabling the attacker to know how traffic will be encrypted when a TLS connection is established.
  • It allows the malware to decode traffic and send www.mcafee/activate relevant data to its command-and-control (C2) server.
  • By decoding the data, the malware remains undetected by administrators or security tools.
  • It shares similar code to the COMpfun trojan which was first documented in 2014 and is closely associated with the Russian Advanced Persistent Threat (APT) group Turla.
  • It has been operational mcafee.com/activate product key since 2019, and has been www.mcafee.com/activate used in a malware campaign targeting entities in Russia and Belarus.
• Trickbot: Trickbot is an infostealer malware that redirects user, system, and user account data to an attacker’s site. It injects malware modules directly into legitimate host software, using spam emails and Adobe Flash Player www.mcafee.com/activate download updates www.mcafee.com/activate product key to execute its attacks. Research has linked Trickbot malware to more COVID 19 phising scam than any other malware. Last month, when Black Lives Matter protests began worldwide over police violence, Trickbot was already being used in phising  scam asking recipients to “leave a review confidentially about Black Lives Matter” or “vote anonymously,” claiming to include a survey in their ask.
• IcedID:  Icedid is a banking trojan that injects malware www.mcafee.com/activate into browser sites, with the ability to spread laterally through the network. When discovered in 2017, it was targeting banks, payment card providers, payroll, webmail and e-commerce sites, and mobile services providers mcafee.com/activate product key. mainly in the U.S. It has continued a focus  www.mcafee/activateon the North American financial sector. For example, recent scam are targeting tax return data, targeting ‘tax software and using customer kits to solicit important documentation from unsuspecting users.’
• Dridex: Dridex is a banking trojan malware detected in 2011 that steals credentials, cookies, certificates, and keystrokes — it can even take screenshots. Dridex relies on phising attacks to execute its malware www.mcafee.com/activate product key. It can capture banking credentials, execute unauthorized www.mcafee.com/activate download transfers from bank accounts, www.mcafee.com/activate open fraudulent accounts, and more. Damage done in 2015 alone was estimated at In December 2019, the Russian hacking group Evil Corp used Dridex to steal  from banks.