For an organization that’s built on trust, ‘data breach’ could be your worst nightmare. However, the problem is all too common, with hackers growing more ingenious and brazen by the day. While some of these attacks cannot be thwarted by even the tightest security systems, most of them can be prevented when adequate precautions are taken. One such malicious but preventable attack is the Man-in-the-Middle attack.
What are Man-in-the-Middle (MitM) attacks?
Like the name suggests, it’s an attack where a hacker gets in the middle of a conversation between a user and a server – without either party being aware of it. The interceptor can eavesdrop on the conversation and read data that passes through or insert their own tools to capture the data.
What causes these attacks?
Every weak point in your network is a potential ingress point for a hacker. A “weak point” in most cases is an endpoint, like websites or firewall, that isn’t properly secured with authentication keys and their corresponding certificates. The authentication keys encrypt information that passes between the site and the browser while certificates validate the credibility of the site. In the absence of this infrastructure (known as Public Key Infrastructure or PKI), hackers can spoof official websites and divert data passed on by unsuspecting users into their own illegal sites.
Spoof emails are also a common way of getting users to give up their data. In this technique, hackers send emails that look like they’re coming from an authorized site, prompting users to perform actions that ultimately expose and jeopardize their personal information.
How serious are these attacks?
Because MitM attacks are responsible for about 35% of network weakness exploitations, they’re very serious indeed. Hackers are privy to sensitive data like login credentials, account information, and credit card details that can be used to manipulate the victim’s online activities or used as a premium for extortion. Banks are especially susceptible to MitM attacks owing to the large sums of money that hackers stand to gain for their troubles.
How can they be prevented?
Since MitM attacks are facilitated by weaknesses in the network infrastructure, fortifying the network is the best possible solution. Fortifying here means the proper implementation of the SSL/TLS protocol, which involves upgrading websites from HTTP to the padlocked, encrypted HTTPS. HTTPS websites are bound by PKI, meaning a website will be connected to the browser only after its certificate has been verified and found to be valid. This check ensures that the user is accessing the genuine website that they requested for and not a lookalike that’s created by hackers looking to pull off a MitM attack. It enforces digital certificates on email communication as well, effectively nipping phishing in the bud.
Having a PKI in place solves only half the problem. More often than not, hackers strike when a certificate expires and is not renewed immediately. Without the protection of certificates and keys, the network is left defenseless is becomes a playground for hackers to practice their craft. This shifts the spotlight to the necessity of certificate management.
What is certificate management?
It involves overseeing the lifecycle of certificates, right from when they’re requested from the CA to their remediation or revocation. Closely monitoring certificates along every step preempts unpleasant surprises like certificate expiration and the subsequent MitM attacks, among many others.
However, an enterprise’s network may host a thousand certificates on average, and manually keeping tabs on each of them is tedious and susceptible to errors. This is where an automated certificate management system, like AppViewX’s CERT+, proves indispensable. CERT+ meticulously discovers certificates residing in your network and inventories them for quick and easy lookups. It integrates seamlessly with all popular CAs and your network endpoints both, so you can raise CSRs and provision certificates as you receive them in just a few clicks. The platform periodically sends alerts when certificates near their expiry, so that you can renew or revoke them in time and make your network immune to outages and MitM attacks.
Try CERT+ now, or book a demo with us.
Tags
About the Author
