Methods and systems for certificate filtering
SSL/TLS certificate filtering devices, systems and processes may filter packets based on risk associated with each packet. A risk score may be determined for each packet based on associated threats and risks. Risk scores may be determined based on certificates, certificate authorities, and/or end users associated with each packet. The certificates may be scored and/or categorized by threats and risk.
1. A method comprising:
receiving, by a certificate data collector and from one or more threat intelligence providers, threat intelligence data associated with a plurality of hosts, wherein the threat intelligence data indicates a first host that has been identified as a potential threat by the one or more threat intelligence providers;
in response to receiving the threat intelligence data, determining, by the certificate data collector, one or more certificate authorities that have issued one or more certificates to the first host;
receiving, by the certificate data collector and from one or more external systems that identify certificates and certificate authorities associated with hosts, certificate authority intelligence information associated with the one or more certificate authorities that were determined to have issued the one or more certificates to the first host;
determining a risk score associated with each certificate authority of the one or more certificate authorities, wherein the risk score associated with a particular certificate authority is determined based on:
the threat intelligence data indicating that the first host has been identified as a potential threat by the one or more threat intelligence providers; and
the certificate authority intelligence information associated with the one or more certificate authorities indicating that the particular certificate authority issued a certificate to the first host;
sending, to a client system, the determined risk scores associated with each certificate authority of the one or more certificate authorities;
generating, based on the determined risk scores associated with each certificate authority, one or more packet-filtering rules; and
sending, to a packet-filtering device associated with the client system, the one or more packet-filtering rules, wherein the packet-filtering device is configured to apply the one or more packet-filtering rules to network traffic.
2. The method of claim 1 , wherein the client system is further configured to generate, based on the determined risk scores associated with each certificate authority, one or more second packet-filtering rules.
3. The method of claim 1 , wherein the threat intelligence data comprises at least one of:
a domain name associated with the first host; or
an internet protocol (IP) address associated with the first host.
4. The method of claim 1 , wherein the one or more certificates form a chain of trust.
5. The method of claim 1 , further comprising:
determining a first risk score associated with a first certificate authority based on identifying the first certificate authority as being associated with a cyber threat organization.
6. The method of claim 1 , wherein determining the risk score associated with each certificate authority comprises:
assigning, based on one or more threat indicators identified in the threat intelligence data, a risk score to each certificate authority that issued a certificate to the first host.
7. The method of claim 1 , further comprising:
determining, based on the threat intelligence data, a second risk score associated with each respective certificate of one or more certificates issued to the first host; and
sending, by the certificate data collector and to a packet-filtering device associated with the client system, the second risk score associated with each respective certificate of the one or more certificates issued to the first host, along with the risk scores associated with each certificate authority.
8. The method of claim 7 , further comprising:
generating, based on the risk scores associated with each certificate authority and based on the second risk score associated with each respective certificate of the one or more certificates, a packet-filtering rule.
9. The method of claim 1 , wherein the risk score associated with the particular certificate authority is further based on at least one of:
a determination of whether the particular certificate authority issued a second certificate to known malware sites;
a determination of whether a second certificate has been revoked; or
a determination that the certificate issued to the first host is a self-signed certificate.
10. The method of claim 1 , wherein the client system comprises a packet-filtering device that resides at a boundary between, and interfaces with, a protected network and an unprotected network.
11. The method of claim 1 , wherein the one or more packet-filtering rules comprise one or more rules configured to:
protect a network associated with the client system from malicious network traffic; or
prevent malicious traffic from leaving the network associated with the client system.
12. A certificate data collector comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the certificate data collector to:
receive, from one or more threat intelligence providers, threat intelligence data associated with a plurality of hosts, wherein the threat intelligence data indicates a first host that has been identified as a potential threat by the one or more threat intelligence providers;
determine, in response to receiving the threat intelligence data, one or more certificate authorities that have issued one or more certificates to the first host;
receive, from one or more external systems that identify certificates and certificate authorities associated with hosts, certificate authority intelligence information associated with the one or more certificate authorities that were determined to have issued the one or more certificates to the first host;
determine a risk score associated with each certificate authority of the one or more certificate authorities, wherein the risk score associated with a particular certificate authority is determined based on:
the threat intelligence data indicating that the first host has been identified as a potential threat by the one or more threat intelligence providers; and
the certificate authority intelligence information associated with the one or more certificate authorities indicating that the particular certificate authority issued a certificate to the first host;
send, to a client system, the determined risk scores associated with each certificate authority of the one or more certificate authorities;
generate, based on the determined risk scores associated with each certificate authority, one or more packet-filtering rules; and
send, to a packet-filtering device associated with the client system, the one or more packet-filtering rules, wherein the packet-filtering device is configured to apply the one or more packet-filtering rules to network traffic.
13. The certificate data collector of claim 12 , wherein the client system is further configured to generate, based on the determined risk scores associated with each certificate authority, one or more second packet-filtering rules.
14. The certificate data collector of claim 12 , wherein the threat intelligence data comprises at least one of:
a domain name associated with the first host; or
an internet protocol (IP) address associated with the first host.
15. The certificate data collector of claim 12 , wherein the one or more certificates form a chain of trust.
16. The certificate data collector of claim 12 , wherein the instructions, when executed by the one or more processors, cause the certificate data collector to determine a first risk score associated with a first certificate authority by identifying the first certificate authority as being associated with a cyber threat organization.
17. The certificate data collector of claim 12 , wherein the instructions, when executed by the one or more processors, cause the certificate data collector to determine the risk score associated with the certificate authority by assigning, based on one or more threat indicators identified in the threat intelligence data, a risk score to each certificate authority that issued a certificate to the first host.
18. The certificate data collector of claim 12 , wherein the instructions, when executed by the one or more processors, cause the certificate data collector to:
determine, based on the threat intelligence data, a second risk score associated with each respective certificate of one or more certificates issued to the first host; and
send, to a packet-filtering device associated with the client system, the second risk score associated with each respective certificate of the one or more certificates issued to the first host along with the risk scores associated with each certificate authority.
19. The certificate data collector of claim 18 , wherein the instructions, when executed by the one or more processors, cause the certificate data collector to generate, based on the risk scores associated with each certificate authority and based on the second risk score associated with each respective certificate of the one or more certificates, a packet-filtering rule.
20. The certificate data collector of claim 12 , wherein the risk score associated with the particular certificate authority is further based on at least one of:
a determination of whether the particular certificate authority issued a second certificate to known malware sites;
a determination of whether a second certificate has been revoked; or
a determination that the certificate issued to the first host is a self-signed certificate.
21. The certificate data collector of claim 12 , wherein the client system comprises a packet-filtering device that resides at a boundary between, and interfaces with, a protected network and an unprotected network.
22. The certificate data collector of claim 12 , wherein the one or more packet-filtering rules comprise one or more rules configured to:
protect a network associated with the client system from malicious network traffic; or
prevent malicious traffic from leaving the network associated with the client system.
23. A non-transitory computer-readable medium comprising instructions that, when executed, cause a certificate data collector to:
receive, from one or more threat intelligence providers, threat intelligence data associated with a plurality of hosts, wherein the threat intelligence data indicates a first host that has been identified as a potential threat by the one or more threat intelligence providers;
determine, in response to receiving the threat intelligence data, one or more certificate authorities that have issued one or more certificates to the first host;
receive, from one or more external systems that identify certificates and certificate authorities associated with hosts, certificate authority intelligence information associated with the one or more certificate authorities that were determined to have issued the one or more certificates to the first host;
determine a risk score associated with each certificate authority of the one or more certificate authorities, wherein the risk score associated with a particular certificate authority is determined based on:
the threat intelligence data indicating that the first host has been identified as a potential threat by the one or more threat intelligence providers; and
the certificate authority intelligence information associated with the one or more certificate authorities indicating that the particular certificate authority issued a certificate to the first host; and
send, to a client system, the determined risk scores associated with each certificate authority of the one or more certificate authorities;
generate, based on the determined risk scores associated with each certificate authority, one or more packet-filtering rules; and
send, to a packet-filtering device associated with the client system, the one or more packet-filtering rules, wherein the packet-filtering device is configured to apply the one or more packet-filtering rules to network traffic.
24. The non-transitory computer-readable medium of claim 23 , wherein the client system is further configured to generate, based on the determined risk scores associated with each certificate authority, one or more second packet-filtering rules.
25. The non-transitory computer-readable medium of claim 23 , wherein the threat intelligence data comprises at least one of:
a domain name associated with the first host; or
an internet protocol (IP) address associated with the first host.
26. The non-transitory computer-readable medium of claim 23 , wherein the one or more certificates form a chain of trust.
27. The non-transitory computer-readable medium of claim 23 , wherein the instructions, when executed, cause the certificate data collector to determine a first risk score associated with a first certificate authority by identifying the first certificate authority as being associated with a cyber threat organization.
28. The non-transitory computer-readable medium of claim 23 , wherein the instructions, when executed, cause the certificate data collector to determine the risk score associated with each certificate authority by assigning, based on one or more threat indicators identified in the threat intelligence data, a risk score to each certificate authority that issued a certificate to the first host.
29. The non-transitory computer-readable medium of claim 23 , wherein the instructions, when executed, cause the certificate data collector to:
determine, based on the threat intelligence data, a second risk score associated with each respective certificate of the one or more certificates issued to the first host; and
send, to a packet-filtering device associated with the client system, the second risk score associated with each respective certificate of the one or more certificates issued to the first host along with the risk scores associated with each certificate authority.
30. The non-transitory computer-readable medium of claim 29 , wherein the instructions, when executed, cause the certificate data collector to generate, based on the risk scores associated with each certificate authority and based on the second risk score associated with each certificate of the one or more certificates, a packet-filtering rule.
31. The non-transitory computer-readable medium of claim 23 , wherein the risk score associated with the particular certificate authority is further based on at least one of:
a determination of whether the particular certificate authority issued a second certificate to known malware sites;
a determination of whether a second certificate has been revoked; or
a determination that the certificate issued to the first host is a self-signed certificate.
32. The non-transitory computer-readable medium of claim 23 , wherein the client system comprises a packet-filtering device that resides at a boundary between, and interfaces with, a protected network and an unprotected network.
33. The non-transitory computer-readable medium of claim 23 , wherein the one or more packet-filtering rules comprise one or more rules configured to:
protect a network associated with the client system from malicious network traffic; or
prevent malicious traffic from leaving the network associated with the client system.