TLS-Observer : a framework for real-time TLS data visualization, audit, and incident response
Δημήτρης Μπαχτής, Dimitris Bachtis · Dione (University of Piraeus) · 2015
Web PKI and the TLS ecosystem as a whole is fragile. It is as strong as its weakest link and its integrity can be easily compromised by any of its links. TLS infrastructure requires continuous monitoring for any organisation to be able to respond to incidents that come up, from bugs in specific implementations and software to root CAs or certificates being compromised or even backdoored. TLS-Observer is a framework that provides real-time and distributed compliance auditing of TLS configurations amongst the vast network hosts of an organisation. It can help system administrator have an overview of the compliance level of their systems and even help them identify deficiencies and reach a better level of security. It can also help incident response by crawling the network in real time for specific vulnerabilities. Building on Go's out of the box concurrency, TLS-Observer offers a fast and reliable framework that can be used in all kinds of organisations and can also aid researchers get an overview of the TLS space all over the Internet without having to crunch all the data themselves. More info and source code can be found on : https://github.com/mozilla/TLS-Observer