Cryptographic security audit using network service zone locking
In one embodiment, a service receives captured traffic flow data regarding a traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone. The service identifies, from the captured traffic flow data, one or more cryptographic parameters of the traffic flow. The service determines whether the one or more cryptographic parameters of the traffic flow satisfy an inter-zone policy associated with the first and second network zones. The service causes performance of a mitigation action in the network when the one or more cryptographic parameters of the traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.
1. A method comprising:
receiving, at a service, captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
identifying, by the service and from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
determining, by the service, whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface; and
causing, by the service, performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.
2. The method as in claim 1 , wherein the mitigation action comprises one of: sending an alert via the network or blocking the encrypted traffic flow.
3. The method as in claim 1 , wherein the first network zone is located in a local area network (LAN) and the second network zone is located outside of the LAN.
4. The method as in claim 1 , wherein the first and second network zones are located in a same local area network (LAN).
5. The method as in claim 1 , wherein the one or more cryptographic parameters comprise at least one of: a cyphersuite or key length used in the encrypted traffic flow.
6. The method as in claim 5 , wherein the cyphersuite represents a particular combination of hash type, signature type, encoding type, authentication type, and key exchange type.
7. The method as in claim 5 , wherein the key length comprises a signature key size or client key size used in the encrypted traffic flow.
8. The method as in claim 1 , further comprising:
determining, by the service, that the first device is associated with the first zone based on an Internet Protocol (IP) address of the first device.
9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
receive captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
identify, from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
determine whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface; and
cause performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.
10. The apparatus as in claim 9 , wherein the mitigation action comprises one of: sending an alert via the network or blocking the encrypted traffic flow.
11. The apparatus as in claim 9 , wherein the first network zone is located in a local area network (LAN) and the second network zone is located outside of the LAN.
12. The apparatus as in claim 9 , wherein the first and second network zones are located in a same local area network (LAN).
13. The apparatus as in claim 9 , wherein the one or more cryptographic parameters comprise at least one of: a cyphersuite or key length used in the encrypted traffic flow.
14. The apparatus as in claim 13 , wherein the cyphersuite represents a particular combination of hash type, signature type, encoding type, authentication type, and key exchange type.
15. The apparatus as in claim 13 , wherein the key length comprises a signature key size or client key size used in the encrypted traffic flow.
16. The apparatus as in claim 9 , wherein the process when executed is further configured to:
determine, that the first device is associated with the first zone based on an Internet Protocol (IP) address of the first device.
17. The apparatus as in claim 9 , wherein the process when executed is further configured to:
provide, to the user interface, a listing of cryptographic parameters observed in the network; and
receive the inter-zone policy from the user interface, after providing the listing of cryptographic parameters to the user interface.
18. The apparatus as in claim 9 , wherein the apparatus is an intermediate networking device between the first and second network zones.
19. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:
receiving captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
identifying, from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
determining whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface; and
causing performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.
20. The computer-readable medium as in claim 19 , wherein the one or more cryptographic parameters comprise at least one of: a cyphersuite or key length used in the encrypted traffic flow.