Heartbleed's left a nasty lasting legacy, warns Palo Alto Networks

The visible impact of Heartbleed was displayed in updates on web applications, such as Yahoo!, Google, Dropbox, Facebook, online banking, and the thousands of other vulnerable targets on the web. The world has moved on, believing Heartbleed is behind us.

But Sharat Sinha, Vice President, Asia Pacific for Palo Alto Networks, says that Heartbleed has a lasting legacy. "The Heartbleed vulnerability puts the tools that were once reserved for truly advanced cyber criminals into the hands of the average attacker, notably, the ability to breach organisations and move laterally within them," he cautioned.

“Most enterprises of even moderate size do not have a good handle on what services they are running internally using SSL encryption, much less those that the end-users have brought into the network. More importantly, they don’t inspect applications for malicious activity.”

The Palo Alto Networks Application Usage and Threat Report provides a detailed assessment of the relationship between advanced cyber threats and the applications running on enterprise networks worldwide. In Asia Pacific, the survey revealed that

• 32% of applications are capable of using SSL. 
• The top ten sub-categories in the enterprise that can use SSL include file-sharing, instant messaging, social networking, photo-video, internet conferencing, remote access, internet-utility, management, email and general business. 

Sinha explained that SSL use is a much bigger problem today than compared to just a year ago. "If organisations don’t know how many applications running on the network use SSL, they also don’t know how many of those applications use OpenSSL, which may directly or indirectly expose the organisation," he said.

“Proofs-of-concept that take advantage of Heartbleed are no doubt in the works. It is only a matter of time before an automated internal scanner is developed that finds vulnerable services on the local network and exploits them with a single click. The challenges that presents to organisations is significant. For example, once you know how many internal applications may be using OpenSSL, how difficult will it be to update them? If it is a business-critical application, the effort is not small."

What can businesses do? “Organisations must determine which applications are capable of using SSL, both the business applications and those in use by employees, then determine which of them use OpenSSL. Knowing which applications are using SSL, who is using them, and what network resources the person has access to will let organisations gauge and then minimise their
exposure.”

Read the post about the report here.