A Brief History of TLS Implications of the TLS Deprecation TLS Upgrade: Challenges and Recommendations How AppViewX Assissts the TLS Migration

1. © 2019 AppViewX, Inc. 1
The TLS Upgrade
Migrating Away from TLS 1.0 and 1.1

2. © 2019 AppViewX, Inc. 2
2
Agenda
Implications of the TLS Deprecation
The Upgrade: Challenges and Recommendations
2
3
A Brief History of TLS1
How AppViewX Assists the TLS Migration4

3. © 2019 AppViewX, Inc. 3
A Brief History of TLS
TLS 1.2 is Released TLS 1.3 is Released
TLS 1.0 & 1.1 will
be deprecated.
TLS 1.1 is ReleasedTLS 1.0 is Released
 Major Browsers
announce early
2020 end-of-
support for TLS
1.0, 1.1
 [Apple, Google,
Mozilla,
Microsoft]
(+) Cipher Suite
Specified
Pseudorandom
Functions
(+) AES Cipher Suites
(+) Functional
Enhancements
(-) IDEA Cipher Suites
(-) DES Cipher Suites
Minor Upgrade to
TLS 1.0
(+) Protection
Against Cipher
Block Chaining
(CBC) Attacks
(+) Single Round-
Trip Handshake
(+) Encryption of
SNI Info
(+) RSA-PSS Support
(-) SHA-1
(-) MD5
(-) RC4
(-) DES
(-) 3ES
 A replacement
to SSL 3.0
 Similar to SSL,
but prevents
interoperability
1999 2006 2008 2018 2020

4. © 2019 AppViewX, Inc. 4
The Immediate Effects of TLS Deprecation
Loss of recognition
from Big 4 Internet
Browsers
Once deprecated, clients can no longer connect to services using TLS 1.0 and 1.1.
Result:
Exposure to
vulnerabilities of
older versions
(Ex: Downgrade Attacks,
Failing PCI Compliance
Checks)
PCI Supports TLS 1.1 and upwards, strongly
recommends TLS 1.2

5. © 2019 AppViewX, Inc. 5
Preparing for an Upgrade
Renew x.509 Certificates
Replace/Update Web
Servers
Ensure Application and API
Support of TLS 1.2/1.3
Configure TLS Securely

6. © 2019 AppViewX, Inc. 6
TLS 1.2 vs. TLS 1.3
TLS 1.3 is fairly recent, with TLS 1.2 being over a decade old. According to Mozilla, 93% of TLS
sessions in 2018 used TLS 1.2, with only 5.6% using TLS 1.3. However, TLS 1.3 boasts of vastly
greater performance and experts recommend its use right away.
Being a newer protocol, TLS 1.3 has several key advantages over its predecessor.
Zero/One Round-Trip Handshakes
Removal of SHA-1, DES, AES-CBC etc.
No Vulnerability to RC4, BEAST
exploits
Perfect Forward Secrecy
RSA-PSS Standard Implementation
Provision to Encrypt SNI Information

7. © 2019 AppViewX, Inc. 7
Migrating to TLS 1.2/1.3 : Challenges
o The average organization has thousands of applications and
systems supporting TLS 1.0 or 1.1.
o Each application has one or more devices supporting TLS 1.0 or
1.1.
o Manually switching every device to TLS 1.0 is tedious and error-
prone.
o An automation tool that can efficiently migrate/update the
device to TLS 1.2/1.3-compatible ones is a safe, cost-effective
method.

8. © 2019 AppViewX, Inc. 8
Migrating to TLS 1.2/1.3 : Recommendations
 Configure end systems to disable TLS 1.0/1.1
 Identify technology to replace vulnerable protocols
and document secure configurations to be
implemented.
 Identify all system components and data flows that
rely on OR support the obsolete protocols.
 Ensure that servers are TLS 1.2/1.3 cipher
compatible.
 Discover and verify endpoint compatibility with TLS
1.2 and above.
 Endpoint rectification by enabling TLS 1.2 and above.
 Block vulnerable ciphers (TLS 1.0, 1.1) on endpoints
and plan for a quick rollback if needed.

9. © 2019 AppViewX, Inc. 9
How can I prime my PKI to work with an upgraded TLS?
Identify Vulnerable Devices
Scan your entire network to
discover and locate Clients
and Servers
Migrate Certificate Keys
Migrate the hash function
from SHA1 to SHA256 to
support TLS 1.2 and above
Renew Certificates
Contact CAs to renew
certificates with the SHA256
key type.
Push to Endpoints
Install the renewed
certificates on their
respective endpoints.

10. © 2019 AppViewX, Inc. 10
End-to-End Automation Platform: AppViewX CERT+
Growing List of Integrations
ITSM
Web App Firewall
Firewall
Access Proxy
CA
DDI
SSL Certificates
ADC
HSM
SDN, Branch, NFV

11. © 2019 AppViewX, Inc. 11
Accelerated Certificate Renewal and Installation
Automated installation on endpoints
Achieve an up-to-date certificate infrastructure
Scan environments and discover vulnerable devices
Set up an automation workflow for bulk renewals
Group them according to replacement criteria

12. © 2019 AppViewX, Inc. 12
CA-Agnostic Discovery Engine
Certificate Discovery Control Panel
Inventory Report

13. © 2019 AppViewX, Inc. 13
Zero-touch Control over Certificate Infrastructure
Holistic View of
Certificate Trust
Chain

14. © 2019 AppViewX, Inc. 14
Process Automation with Visual Workflows
Certificate
Process
Workflow
Builder

15. © 2019 AppViewX, Inc. 15
Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints
Step 1: Select Endpoint(s)

16. © 2019 AppViewX, Inc. 16
Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints
Step 2: Check current version of endpoint(s)

17. © 2019 AppViewX, Inc. 17
Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints
Step 3: Disable TLS 1.0/1.1 on endpoint(s)

18. © 2019 AppViewX, Inc. 18
Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints
Step 4: Implementation of TLS 1.0/1.1 disablement

19. © 2019 AppViewX, Inc. 19
Custom Workflow: Auto-Disabling TLS 1.0/1.1 on Endpoints
Step 5: Check TLS version post disablement of vulnerable version

20. © 2019 AppViewX, Inc. 20
Value Proposition of Certificate Lifecycle Automation
ELIMINATE
ERRORS
Remove manual
steps in development and
production
ENFORCE
COMPLIANCE
Deliver and
protect applications
as you intend
MOVE
FASTER
Automate network
infrastructure
services
REDUCE
COST
Take out
complexity and
do more with less

21. © 2019 AppViewX, Inc. 21
Real-world Business Benefits of AppViewX
Reduction in
Issuance Time
Reduction in
Deployment Time
Reduction in
Configuration Time
70% 83% 70% 0%
Configuration
Errors
0%
Outages

22. © 2019 AppViewX, Inc. 22
Schedule a Live Demo