Encryptedtraffic

Encrypted
TrafficAnalysis

Sc
anning…

Detect risks in encrypted traffic.
Understand the scope.
Respond immediately.
Encryption is on the rise and for a good reason, too - the protection of customer
information and business-sensitive data is of great concern to all businesses today.
Although it is necessary for data protection, encryption creates certain obstacles forsecurity teams, who are still required to protect their networks in spite of the lack ofvisibility. Moreover, encryption can be used by attackers to mask their intentions, andweak encryption can even be exploited to their advantage. It is estimated that up
to 50 % of all known cyber attacks use encryption, and there is universal agreementthat encrypted traffic is an important source of security risks.
In spite of this, many businesses still lack the means to monitor encrypted traffic,
where up to a half of organizations cannot detect malicious SSL traffic. The Flowmon
solution addresses this need and offers the necessary insight while remaining
scalable, easily integrable and, most importantly, respectful of privacy.

50%

70%of all known cyber attacks use
encryption to evade detection.

of organizations fear the exposure ofsensitive personal data due to decryption

According to IDG Connect

According to IDG Connect

What Encrypted Traffic
Analysis does

“Our priority was to improve thevisibility of our infrastructure, as in our
manufacturing segment network outages
automatically lead to financial losses. So
we decided that besides the tools suchas Cisco Prime we would invest in a flow
data monitoring solution.”

Flowmon provides administrators with the insight required to counter malware andcyber threats that take advantage of encryption to sneak in. Here are a few examplesof what ETA can monitor and detect:
COMPLIANCECYBERSECURITY

Expired and non-compliant SSL certificatesto show which applications need an update

Malware-infected stations diagnosedby anomalies in SSL parameters

Encryption strength by monitoring
key length and algorithm

Malware C&C center communication
revealed by JA3 fingerprinting

Unwanted TLS versions that containvulnerabilities

Man-in-the-middle attacks manifested
by unusual or illegitimate certificates

Non-compliant clients accessing unwantedsites discovered by server name identification

Peter Skorvanek
Network Administrator at KIA

Suspicious packet size indicating
data exfiltration

Motors Slovakia

How Encrypted TrafficAnalysis works

BENEFITS OF ETA

Flowmon’s encrypted traffic analytics collects network traffic metadata in the IPFIX
format using passive probes and enriches it with TLS protocol information (amongothers). These attributes of the encrypted session between clients and servers areavailable regardless of the client’s physical location or whether the server runs in theBreach impact minimization

Reduction of risk

Flowmon monitors network traffic and proactively

Prevent breaches by identifying

alerts on potential compromise, so that the breachnon-compliant, high-risk assets.

cloud or datacenter. This provides a wealth of information about the traffic and allows
for the identification of out-of-date SSL certificates, policy non-compliant certificates,
encryption strength and old TLS versions that may contain faults or vulnerabilities.
Furthermore, the solution’s machine learning engine uses this data to perform behavior

can be contained in time.

analysis and anomaly detection to identify malware and other threats.
Home office
Corporate site
Public/Privatecloud

Network telemetry

Coffee shop

enriched withSSL/TLS
metadata

SaaS

Fast time to value

Breaking NetOps and SecOps silos

Streamlined deployment, user enablement, predefined

Response time is reduced when bothviews, dashboards and reports. From deployment toteams collaborate on prevention,

data on the dashboard in just 30 minutes.

detection and response.

Malwaredetection

Ciphersuiteand certificate
auditing

AnalyticalengineMachine learning
engineThis approach does not violate privacy, nor does it degrade performance. It providesinsightful analytics regardless of the volume. Moreover, since the data is stored inaggregated form, it saves a considerable amount of storage space without impeding
information fidelity.

Incident
responseandprevention

FEATURES

Privacy preserving

Heterogeneous environments

Using network traffic metadata does

On-premise, remote, hybrid or cloud

not require decryption and causes nomakes no difference. It provides theprivacy compromise.

same insights.

Zero latency impact

Reduce response time

ETA is unobtrusive to the network.

Provide an overview of all relevant

It provides monitoring with noevents and detections without any

impediment to operation.

clutter or information noise.

30 minDay Zero

16x

From deployment todashboard insights

Respond to advanced persistent
threats on Day Zero

Up to 16x faster time
to resolution

Decrypt or analyze?
Many threats misuse SSL/TLS to mask their activities, and ignoring them is a risk thatno organization can afford to take. While decryption is one way of tackling this, it
doesn’t scale down in terms of cost efficiency and robustness to meet the needs ofthe majority of organisations. It is not always the most effective approach, nor is it
always necessary.
Information about encryption is already contained in the network data and can be used
for security and compliance purposes, performance monitoring and troubleshooting.
Since this method is passive and scalable, it is particularly well-suited for real-timemonitoring.
In short, using metadata:
Preserves privacy / doesn’t affect latency / scales with the network / is best practiceand value in the majority of cases.

www.flowmon.com