I understand SSL Web browsers can serve as vectors for malware. Can you explain how that works and how we can prevent...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
malware from infiltrating a network via SSL traffic?
Ask the Expert!
Have questions about enterprise information security threats for expert Nick Lewis? Send them via email today! (All questions are anonymous.)
Web browsers have included support for the Secure Sockets Layer (SSL) protocol, which is a method for encrypting data, since Netscape introduced SSL v2.0 in 1996. Other protocols typically use it to encrypt the contents of the traffic, such as malware content being served over a HTTPS connection to a Web browser. This encryption protects the privacy and security for users, but in the case of malware, it prevents network inspection tools from analyzing the contents of the network for malware. Smart attackers encrypt their communications, using HTTPS to hide their traffic from detection. That malware is transmitted over HTTPS to a Web browser on an endpoint that does not indicate any issues with HTTPS, identify SSL malware per se, or any other SSL security issues, but only identifies an issue with the security of the endpoint and network security controls in place.
I have discussed Web browser security controls for endpoints in previous questions, but there are some network security controls that prevent malware from infiltrating via SSL-encrypted traffic. Most signature-based network security tools cannot identify malware in a HTTPS connection, but a Web proxy with SSL inspection functionality could be used to analyze the content for malware. Behavioral-based network security tools do not have this same limitation. You could also use IP or DNS-based blacklists to prohibit websites that host malware, but this might block legitimate Web traffic.
Dig Deeper on IPv6 security and network protocols security
Related Q&A from Nick Lewis
As the Magento Community Edition suffers a new zero-day vulnerability, expert Nick Lewis explains how it's being exploited and how to mitigate the ...continue reading
Cross-platform malware enables attackers to leverage their attacks using infected Microsoft Word docs. Expert Nick Lewis explains how the attacks ...continue reading
How was the ATMitch malware able to loot cash machines, then delete itself? Expert Nick Lewis explains how the fileless malware works and how it ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.