With more and more WAN optimization vendors extending their capabilities to include encrypted traffic, corporate IT executives have a decision to make: Should they trust the security these devices provide?
Rather than passing through SSL sessions between clients and servers located in remote data centres, some WAN optimization gear can terminate the SSL sessions, shrink the traffic and re-encrypt it for the next leg of the trip. These chains of encrypted sessions introduce potential vulnerabilities that different vendors address in different ways.
SSL traffic represents a growing percentage of total traffic on WAN links, according to Forrester Research. So SSL support in WAN optimization appliances will become more important to businesses that want to keep traffic secure while minimizing the size of their WAN links.
In a survey last month of 1,300 IT executives by WAN-optimization vendor Blue Coat Systems, one-third of respondents said that 25 per cent of their WAN traffic is SSL. And of those surveyed, 45 per cent plan to roll out more SSL applications this year.
About a third of all WAN traffic at Richardson Partners Financial Ltd. in Toronto is SSL, says Andrew McKinney, director of technical services for the firm. But if only the urgent business traffic is considered, the percentage is much higher. “For critical business traffic, it’s all encrypted,” he says. So he uses Blue Coat Systems gear to secure traffic and optimize it for good performance.
But first he got the devices in and grilled the vendor about the security at each point of the proxy chain until he was satisfied it would keep the firm’s data safe. “Our big concern was that we would have control of what was being cached,” he says. He didn’t want sensitive data left on the disk of the Blue Coat appliance.
“We wanted to be sure the data could be flushed as we required but also that it was securely being stored. In the end we were satisfied,” McKinney says.
So far, just three vendors — Blue Coat, Certeon and Riverbed Technology — offer SSL acceleration on their appliances, and the capability is also on the road map for Juniper Networks and Silver Peak.
Such devices sit at both ends of WAN links and perform a number of functions that serve to speed up transaction times. These include optimizing TCP sessions, enforcing QoS, byte-level pattern matching and protocol optimization.
Without SSL support, when SSL traffic hits these boxes they are limited to using TCP optimization and QoS. SSL support relies on terminating SSL sessions, decrypting the traffic-storing segments of the data for future reference and re-encrypting. Later traffic through the devices is compared with these segments. When data being sent matches a segment, the devices send an abbreviated reference rather than the longer complete segment, thereby reducing the amount of traffic that has to cross the wire.
These segments are analogous to paperwork put through a shredder, says Mark Day, chief scientist at Riverbed. “The individual pieces are still intelligible, but total documents are somewhere between difficult and impossible to reconstitute,” he says. Customers concerned that these data segments represent a threat can turn off SSL optimization and pass the traffic through, he says.
Blue Coat doesn’t encrypt the stored segments either, arguing that the difficulty of using the data makes it practically inaccessible. “It’s not encrypted but you’re going to need NSA-level talent to get that information out of the disk,” says Chris King, director of strategic marketing for Blue Coat.
Certeon does encrypt on the disk, storing the keys needed to decrypt it on the appliance that sits across from it on the WAN. That way, if one box is stolen, the data on the disk is secure. In any SSL proxying architecture, the server must give up its certificates to at least one other device. In the cases of Blue Coat, Certeon and Riverbed, that device is a WAN optimizer that sits inside the data centre where it is as physically secure as the server itself. How those certificates are handled varies from vendor to vendor.
Blue Coat creates a session key for its client-side device using the public key of the server that is held by the server-side Blue Coat device. The server-side device uses the private key of the server to decrypt the session key that is used over the WAN.
The fact that SSL sessions are being proxied shouldn’t scare anyone away, says Joe Skorupa, an analyst with Gartner. Akamai, for instance, proxies SSL transactions — some of them involving e-commerce — for its customers, he says. “There’s precedent for doing it and doing it where significant amounts of money are at risk,” Skorupa says, but each potential user has to balance the need for speed and the need for security. 075612
