ThreatEye NV combines behavior analysis and machine learning to expose malware in encrypted network traffic. Credit: Matejmo / Getty Images Encryption can keep bad actors from peeking at critical data, but it can also allow them to hide malicious activity from network defenders. That’s why LiveAction, a network visibility company, has introduced ThreatEye NV, a platform that gives SecOps teams powerful tools to find threats and anomalies in encrypted traffic.“In 2014, about 30% of traffic was encrypted. Now it’s 80% to 90%. By the end of 2025, it will be almost all traffic,” says LiveAction Director of Product Marketing Thomas Pore. “For a network defender, this creates a problem. If you’re unable to get visibility into these encrypted tunnels and connections, how can you identify threats?”Ed Cabrera, chief cybersecurity officer at Trend Micro adds: “Encrypted traffic provides more opportunities for cybercriminals to forge or create legitimate SSL/TLS certificates for their credential phishing sites, deliver malware using encrypted C2 servers, and exfiltrate stolen data using asymmetric and symmetric encryption.” ThreatEye can analyze more than 150 packet traits and behaviors LiveAction explained in a news release that ThreatEye uses Deep Packet Analysis to eliminate the need to decrypt network traffic and inspect it for malicious payloads. The platform can analyze more than 150 packet traits and behaviors across multi-vendor, multi-domain, and multi-cloud network environments. That helps accelerate real-time threat detection, eliminates encryption blindness, validates encryption compliance, and allows teams to better secure the entire network and coordinate responses with other security tools such as SIEM and SOAR, the company added.Other benefits of the platform include: Real-time threat and anomaly detectionElimination of encryption blindness without decryption or performance degradationSimple deployment through a SaaS model with software sensors that can be deployed anywhere visibility is neededSOC support, including dashboards to drive response efficiencyUse of machine-learning models custom-built for specific security and visibility use cases91.5% of malware discovered and blocked was in encrypted traffic“Web encryption and encryption, in general, are good things. They serve a huge business purpose we all want,” says Corey Nachreiner, CSO of Watchguard,a network security company in Seattle, Washington. “Unfortunately, it offers easy and new ways for threat actors to hide from traditional and legacy security controls.”Watchguard tackles the encryption blindness problem with a network appliance. Inside the appliance the traffic is decrypted, inspected, encrypted again, and sent on its way. The approach doesn’t seem to be very popular, though. Nachreiner concedes that only about 20% of Watchguard’s customers use the feature. “Setting it up does require some effort from an administrator,” he admits.However, there are some significant benefits to making the effort to set up the process. Nachreiner notes that in the organizations using decryption, 91.5% of the malware discovered and blocked was in encrypted traffic.Encrypted traffic analysis the future for fortifying security posture“The world has shifted from a security response perspective,” Pore says. “Security analysts can’t rely on only syslog messages to identify challenges. We need to leverage machine learning and identify network traffic and patterns for these advanced attacks.”Pore adds that encryption will continue to get better, making it more difficult and expensive for solutions that depend on decrypting and re-encrypting data to address the issue of encryption blindness. “In future versions of encryption, you’ll have zero visibility,” he says. “That will be a massive problem for defenders. That’s why encrypted traffic analysis is really going to be the future for fortifying an organization’s security posture.” Related content brandpost Sponsored by Microsoft Security Building an AI strategy for the modern SOC Transforming SOC teams with the power of AI—identify the highest risk areas, cybersecurity maturity, existing architecture and tools, and budgetary constraints…just to name a few. By Microsoft Security May 23, 2024 5 mins Security news Tracking manual attacks may deliver zero-day previews According to analysis from LexisNexis, human-based digital fraud attacks are increasing more quickly than bot-based attacks — a difference CISOs should leverage for their defenses. By Evan Schuman May 23, 2024 4 mins Cyberattacks Fraud Cybercrime news analysis Microsoft amps up focus on Windows 11 security to address evolving cyberthreats In addition to its Copilot+ secure-cored PC, the company announced enterprise security enhancements, admin privilege changes, and the deprecation of legacy authentication protocols. By Lynn Greiner May 23, 2024 7 mins Windows Security news LockBit no longer world’s No. 1 ransomware gang After dominating for eight months, LockBit has been overtaken by ransomware gang Play in the wake of a law enforcement crackdown and unmasking of LockBit’s alleged creator. By Viktor Eriksson May 23, 2024 2 mins Ransomware Cybercrime PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe