I understand SSL Web browsers can serve as vectors for malware. Can you explain how that works and how we can prevent...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
malware from infiltrating a network via SSL traffic?
Ask the Expert!
Have questions about enterprise information security threats for expert Nick Lewis? Send them via email today! (All questions are anonymous.)
Web browsers have included support for the Secure Sockets Layer (SSL) protocol, which is a method for encrypting data, since Netscape introduced SSL v2.0 in 1996. Other protocols typically use it to encrypt the contents of the traffic, such as malware content being served over a HTTPS connection to a Web browser. This encryption protects the privacy and security for users, but in the case of malware, it prevents network inspection tools from analyzing the contents of the network for malware. Smart attackers encrypt their communications, using HTTPS to hide their traffic from detection. That malware is transmitted over HTTPS to a Web browser on an endpoint that does not indicate any issues with HTTPS, identify SSL malware per se, or any other SSL security issues, but only identifies an issue with the security of the endpoint and network security controls in place.
I have discussed Web browser security controls for endpoints in previous questions, but there are some network security controls that prevent malware from infiltrating via SSL-encrypted traffic. Most signature-based network security tools cannot identify malware in a HTTPS connection, but a Web proxy with SSL inspection functionality could be used to analyze the content for malware. Behavioral-based network security tools do not have this same limitation. You could also use IP or DNS-based blacklists to prohibit websites that host malware, but this might block legitimate Web traffic.
Dig Deeper on SSL and TLS VPN Security
Related Q&A from Nick Lewis
Conficker malware was found in a German nuclear power plant computer system. Expert Nick Lewis explains the possible impact of malware infections of ...continue reading
OneSoftPerDay, an adware program can install backdoors on PCs, is able to avoid detection from antimalware tools. Expert Nick Lewis explains how to ...continue reading
The hot-patching feature in Windows servers is vulnerable to attacks from APT groups. Expert Nick Lewis explains what hot patching is and how to ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.