ThreatEye NV combines behavior analysis and machine learning to expose malware in encrypted network traffic. Credit: Matejmo / Getty Images Encryption can keep bad actors from peeking at critical data, but it can also allow them to hide malicious activity from network defenders. That’s why LiveAction, a network visibility company, has introduced ThreatEye NV, a platform that gives SecOps teams powerful tools to find threats and anomalies in encrypted traffic.“In 2014, about 30% of traffic was encrypted. Now it’s 80% to 90%. By the end of 2025, it will be almost all traffic,” says LiveAction Director of Product Marketing Thomas Pore. “For a network defender, this creates a problem. If you’re unable to get visibility into these encrypted tunnels and connections, how can you identify threats?”Ed Cabrera, chief cybersecurity officer at Trend Micro adds: “Encrypted traffic provides more opportunities for cybercriminals to forge or create legitimate SSL/TLS certificates for their credential phishing sites, deliver malware using encrypted C2 servers, and exfiltrate stolen data using asymmetric and symmetric encryption.” ThreatEye can analyze more than 150 packet traits and behaviors LiveAction explained in a news release that ThreatEye uses Deep Packet Analysis to eliminate the need to decrypt network traffic and inspect it for malicious payloads. The platform can analyze more than 150 packet traits and behaviors across multi-vendor, multi-domain, and multi-cloud network environments. That helps accelerate real-time threat detection, eliminates encryption blindness, validates encryption compliance, and allows teams to better secure the entire network and coordinate responses with other security tools such as SIEM and SOAR, the company added.Other benefits of the platform include: Real-time threat and anomaly detectionElimination of encryption blindness without decryption or performance degradationSimple deployment through a SaaS model with software sensors that can be deployed anywhere visibility is neededSOC support, including dashboards to drive response efficiencyUse of machine-learning models custom-built for specific security and visibility use cases91.5% of malware discovered and blocked was in encrypted traffic“Web encryption and encryption, in general, are good things. They serve a huge business purpose we all want,” says Corey Nachreiner, CSO of Watchguard,a network security company in Seattle, Washington. “Unfortunately, it offers easy and new ways for threat actors to hide from traditional and legacy security controls.”Watchguard tackles the encryption blindness problem with a network appliance. Inside the appliance the traffic is decrypted, inspected, encrypted again, and sent on its way. The approach doesn’t seem to be very popular, though. Nachreiner concedes that only about 20% of Watchguard’s customers use the feature. “Setting it up does require some effort from an administrator,” he admits.However, there are some significant benefits to making the effort to set up the process. Nachreiner notes that in the organizations using decryption, 91.5% of the malware discovered and blocked was in encrypted traffic.Encrypted traffic analysis the future for fortifying security posture“The world has shifted from a security response perspective,” Pore says. “Security analysts can’t rely on only syslog messages to identify challenges. We need to leverage machine learning and identify network traffic and patterns for these advanced attacks.”Pore adds that encryption will continue to get better, making it more difficult and expensive for solutions that depend on decrypting and re-encrypting data to address the issue of encryption blindness. “In future versions of encryption, you’ll have zero visibility,” he says. “That will be a massive problem for defenders. That’s why encrypted traffic analysis is really going to be the future for fortifying an organization’s security posture.” Related content brandpost Sponsored by Cyber NewsWire Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud By Cyber NewsWire - Paid Press Release May 21, 2024 4 mins Cyberattacks Security opinion Employee discontent: Insider threat No. 1 CISOs who focus only on detection technology — and don’t engage with the human side of the security equation — are missing a key ingredient for insider risk management. By Christopher Burgess May 21, 2024 7 mins CSO and CISO Threat and Vulnerability Management Human Resources how-to Download the hybrid cloud data protection enterprise buyer’s guide From the editors of our sister publication Network World, this enterprise buyer’s guide helps network and security IT staff understand the issues their organizations face around protecting corporate data in a hybrid cloud environment and how to By Neal Weinberg May 20, 2024 1 min Cloud Security Data and Information Security Enterprise Buyer’s Guides news analysis Global stability issues alter cyber threat landscape, ESET reports With conflict on the rise, regional APT groups are increasing activity, altering focus, and putting specific industries in their crosshairs. Here’s what CISOs should know. By Evan Schuman May 20, 2024 4 mins Advanced Persistent Threats Cyberattacks Threat and Vulnerability Management PODCASTS VIDEOS RESOURCES EVENTS SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe