How Upcoming Internet Changes May Blind Your Security Team

No ratings

Presented at ISC2SecureSummit 2019 by

Steve Ruzila

New technologies and changes in how existing protocols are used may not work with current security tools. QUIC, HTTP2, TLS 1.3, puny code DNS, DNS over SSL, and even IPv6 may blind security staff and their tools to exploits and breaches. Though some of these "new" protocols have been around for a while, security analysts and monitoring tool still have difficulty with analysis and recognizing these kinds of traffic. As the Internet gears up for the greater use and more devices and people connected, changes in how older protocols are have been used, additional security layers, and additional new protocols will require that security tools also be updated to analyze network traffic. Security analysts will also need to be trained to recognize these new protocols and traffic types so as to be be able to provide analysis of activities on the network.