The Heartbleed Bug
What exactly is the Heartbleed
Bug?
2 years ago, a modification was made to OpenSSL, an encryption technology
designed to ensure safe harbor for sensitive dat...
How can I tell if I’m affected?
What everyone needs to do:
Visit the micro site.
• The Heartbleed checker lets you enter the URL of any site to check its
...
What security professionals need to do:
Next budget planning
• If considering an open-source security solution vs. a comme...
One of my servers is vulnerable.
What should I do?
1. Immediately upgrade all of your vulnerable servers to the
latest version.
2. Once all systems are upgraded and found to...
Upgrading may take me months.
How do I stop this vulnerability?
Security Advisory
Ensure that you are running a non-vulnerable version
Vulnerability Description
The (1) TLS and (2) DTLS ...
Are my Radware products
vulnerable?
We've tested all of our products.
The Radware Alteon, AppDirector, DefensePro and
DefenseSSL are not vulnerable to the att...
For more information on Heartbleed
and how we’re protecting our
customers, read our press release.
Thank You
www.radware.com
Upcoming SlideShare
Loading in...5
×

The Heartbleed Bug

1,071

Published on

Here's a deeper dive into what you should know (and do) about the Heartbleed bug.

To learn more about Radware application and network security solutions, please visit: http://www.radware.com/Solutions/Security/

Published in: Technology, Education
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
1,071
On Slideshare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
36
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

The Heartbleed Bug

  1. 1. The Heartbleed Bug
  2. 2. What exactly is the Heartbleed Bug?
  3. 3. 2 years ago, a modification was made to OpenSSL, an encryption technology designed to ensure safe harbor for sensitive data traveling around the Web. OpenSSL contains a function known as a heartbeat option – while someone is visiting a website that encrypts data using OpenSSL the computer sends and receives messages – heartbeat messages - from the server to check it is connected. The Heartbleed vulnerability means that hackers can fake heartbeat messages. By exploiting the vulnerability, hackers sidestep the encryption. The nature of the attack is similar to a buffer overflow attack, where a remote attacker exploits a protocol by sending a malformed “heartbeat” request with a payload size bigger than the actual request. In response, the vulnerable server returns a heartbeat response that contains a memory block of up to 64KB in the payload. This memory block can potentially reveal confidential information, including SSL private keys, user passwords and more. Slide 3
  4. 4. How can I tell if I’m affected?
  5. 5. What everyone needs to do: Visit the micro site. • The Heartbleed checker lets you enter the URL of any site to check its vulnerability. Check on the places you frequent. Change your passwords. • Email, social media accounts, banking. Update the log-in info for any site you use that was affected. Monitor. • Keep an eye out for unusual activity. Slide 5
  6. 6. What security professionals need to do: Next budget planning • If considering an open-source security solution vs. a commercial / proprietary, add to your risk and cost calculations the potential damages created by open-source. TCO and ROI models may change considerably based on this item. Next Security Review • Don’t be fooled by 3rd party audit, compliance and validation processes. Understand the known risks, build proper security architecture, and run penetration tests. Next Steps • Review your security architecture. There is always a room to improve. Have you considered Web Application Firewall? IPS solution or DLP? None of them are perfect but the multi-layer approach may save the day. Slide 6
  7. 7. One of my servers is vulnerable. What should I do?
  8. 8. 1. Immediately upgrade all of your vulnerable servers to the latest version. 2. Once all systems are upgraded and found to be non- vulnerable, reissue all certificates that were used. 3. Replace all passwords for both internal and customer use. Slide 8
  9. 9. Upgrading may take me months. How do I stop this vulnerability?
  10. 10. Security Advisory Ensure that you are running a non-vulnerable version Vulnerability Description The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, aka the Heartbleed bug. More details can be found at: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0160 Vulnerability Exposure The impact of the vulnerability depends on the actual OpenSSL version in use. Slide 10
  11. 11. Are my Radware products vulnerable?
  12. 12. We've tested all of our products. The Radware Alteon, AppDirector, DefensePro and DefenseSSL are not vulnerable to the attack. Specific versions of our Web Application Firewall AppWall and the Web Performance Optimization solution FastView were found vulnerable to Heartbleed data-leakage and have been updated. Slide 12
  13. 13. For more information on Heartbleed and how we’re protecting our customers, read our press release.
  14. 14. Thank You www.radware.com
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×