Challenge
SSL/TLS encrypted traffic is pervasive in organizations around the world, representing over 35% of all enterprise
network traffic today. With a 20% annual growth rate, SSL/TLS encrypted traffic increasingly presents a blind spot
in organizations; most current security solutions cannot see or manage this traffic, making it harder to identify and
control malicious activity coming into and leaving enterprise networks – especially malware communication with
command and control systems.
Solution: Blue Coat and DECOYnetTM
Blue Coat’s Encrypted Traffic Management solutions eliminate the
encrypted traffic blind spot and combat the security threats hidden
in encrypted traffic. Using Blue Coat inspection and decryption
technologies like the Blue Coat SSL Visibility Appliance, DECOYnet
is able to run its analysis engines on a network to identify all malware
activities as well as automatic, potentially hidden, communication
channels.
DECOYnet has been designed to address the very characteristics that
prevent current solutions from successfully identifying infected assets
in a short timeframe. It provides a combination of incident reporting
accuracy, appropriate forensic information, filtering out all but the most
high-risk traffic, visual analytical tools, rapid deployment and automated
maintenance. Throughout the monitoring, an ongoing automated
process is analyzing all the protocols involved in the traffic flow, starting
with TCP, DNS, SSL, HTTP, FTP, SSH, etc. and using its patent-pending
technology to identify the Human Browsing Session traffic. These
different events are correlated over time to produce accurate incident
reports equipped with all the required forensic data supporting quick
identification of the attacker’s activities.
The Blue Coat SSL Visibility Appliance is an integral component to
an organization’s encrypted management strategy. This innovative
Partner: TopSpin Security
Partner Product: DECOYnetTM
Blue Coat Product: SSL Visibility Appliance
appliance identifies, inspects and decrypts multiple streams of SSL/
TLS network traffic across all network ports to provide security devices
with the necessary visibility and control of previously encrypted traffic
and applications. The SSL Visibility Appliance identifies all SSL traffic
regardless of TCP port or application and allows the control of this traffic
via advanced policies. By selectively decrypting traffic, organizations
can effectively control and balance the data privacy and compliance
requirements with the necessary security to protect them against
modern threats.
By combining the SSL Visibility Appliance with TopSpin’s DECOYnet,
you can now analyze network traffic of all kinds and in all parts of the
network, including encrypted traffic, to best detect and defeat attacks
in progress. DECOYnet reveals the presence of malware and attackers
that have infiltrated your network to steal your information, using a
new and unique approach of decoys and traps in the network, while
identifying CnC-asset communication. Once DECOYnet has discovered
an attacker at work, it proceeds to deceive, confuse and slow down the
attack. This is a very different mode of operation compared to security
products such as firewalls, IPSs and anti-virus, which attempt to identify
and stop malware from entering your system. DECOYnet by comparison
is dedicated to identifying intruders by their behavior without any
preconceptions about how the target suspect might look, or how it
came to be there. DECOYnet is easily installed out of line in the network
requiring minimal configuration. Incidents are quickly analyzed by the
security team based on the precise information provided for each one of
the correlated events.
SOLUTION BRIEF
BLUE COAT TECHNOLOGY PARTNER:
TOPSPIN SECURITY
SOLUTION BRIEF
How it Works
The diagram below demonstrates how Blue Coat and
TopSpin work together to provide a more effective
defense-in-depth solution for advanced threats.
The SSL Visibility Appliance uses its comprehensive
policy engine to selectively decrypt traffic and send
it to the TopSpin DECOYnet devices, which then run
their analysis engines to identify and detect all malware
activities in the network.
Benefits
The combined SSL Visibility Appliance and TopSpin
Security solution:
• Comprehensive network visibility into all traffic,
encrypted or otherwise
• Powerful policy-based enforcement of inbound and
outbound traffic
• Apply all analysis engines for the entire egress/ingress traffic
• Detect the malware whether it is using plain text or SSL/TLS
• Detect all communication channels used by the organization
About TopSpin Security
Blue Coat Systems Inc.
www.bluecoat.com
Corporate Headquarters
Sunnyvale, CA
+1.408.220.2200
EMEA Headquarters
Hampshire, UK
+44.1252.554600
APAC Headquarters
Singapore
+65.6826.7000
TopSpin Security provides a solution that protects your organization
from loss of valuable data and prevents disruption of your operations.
The emphasis is on accuracy, minimal overhead and simplicity
of deployment and usage. The company’s solution DECOYnetTM
incorporates a set of unique security engines that discover infected
assets in your organization before damage is done. These include active
deception, automatic configuration to your network and automated
structured analysis of your network traffic.
Learn more: www.topspinsec.com, our blog and Twitter.
© 2016 Blue Coat Systems, Inc. All rights reserved. Blue Coat, the Blue Coat logos, ProxySG, PacketShaper, CacheFlow, IntelligenceCenter, CacheOS, CachePulse, Crossbeam, K9, the K9 logo, DRTR, MACH5, PacketWise, Policycenter, ProxyAV, ProxyClient,
SGOS, WebPulse, Solera Networks, the Solera Networks logos, DeepSee, “See Everything. Know Everything.”, “Security Empowers Business”, and BlueTouch are registered trademarks or trademarks of Blue Coat Systems, Inc. or its affiliates in the U.S. and certain
other countries. This list may not be complete, and the absence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped using the trademark. All other trademarks mentioned in this document owned by third parties
are the property of their respective owners. This document is for informational purposes only. Blue Coat makes no warranties, express, implied, or statutory, as to the information in this document. Blue Coat products, technical services, and any other technical data
referenced in this document are subject to U.S. export control and sanctions laws, regulations and requirements, and may be subject to export or import regulations in other countries. You agree to comply strictly with these laws, regulations and requirements, and
acknowledge that you have the responsibility to obtain any licenses, permits or other approvals that may be required in order to export, re-export, transfer in country or import after delivery to you. v.SB-TECHPARTNER-SSL-TOPSPIN-SECURITY-EN-v1b-0316