Recover an RSA Private Key from a TLS v1.2 session
Cyberattacks happen every day. Most organizations have administrative and technical controls implemented to mitigate the risk of exposure.They are recommended to protect Personal Identifiable Information or Personal Information due to General Data Protection Regulation. Organizations can use encryption to protect Personal Identifiable Information at rest and in transit.Transport Layer Security (TLS) is globally used as the standard to encrypt traffic between two systems. Protection of information relies on the randomness and secrecy of cryptographic keys. If cryptographic keys are not generated correctly, a malicious user can decrypt the traffic. This introduces an additional security risk when personal information might be protected.
sans-recover-an-rsa-private-key-from-a-tls-v1-2-session (PDF, 5.83MB)
22 Jun 2022Related Content
A New Era in Vulnerability Management: A SANS Review of the Seemplicity Platform
Research PaperIn this paper, Dave Shackleford offers an inside look at Seemplicity, a vendor-agnostic remediation orchestration platform designed to unify vulnerability management across code, cloud, and infrastructure.
- 18 Aug 2025
- Dave Shackleford
Adopting an Offensive Security Posture: Strategies and Best Practices
Research PaperThis paper delves into essential concepts, and offers practical guidance for adopting an offensive security posture.
- 18 Aug 2025
- Jorge Orchilles
Enhanced Decisions with WatsonX: A Look at IBM QRadar Investigation Assistant
Research PaperThis paper examines IBM QRadar Investigation Assistant, an AI-powered tool that enhances SOC performance by streamlining incident triage, automating threat enrichment, and enabling natural language query capabilities.
- 6 Aug 2025
- Matt Bromiley
Balancing On-Prem and Cloud Security Strategic Considerations for Modern Organizations
Research PaperThis paper examines the strategic trade-offs between cloud and on-prem deployments, and the growing trend of consolidating tools into integrated security platforms.
- 30 Jul 2025
- Matt Bromiley
Evaluating Zero Trust Network Access: A Framework for Comparative Security Testing
Research PaperWhile most evaluations rely on vendor checklists and surface-level comparisons, this white paper takes a different approach: building and applying a hands-on testing framework grounded in NIST SP 800-207 and the CISA Zero Trust Maturity Model.
- 11 Jul 2025
Defense in Depth: Multiple Layers of Protection Fortifying Your Cyber Defenses
Research PaperDownload this paper and learn how to implement and evolve a Defense-in-Depth (DiD) strategy tailored to your organization’s risk profile, infrastructure, and cloud environment.
- 10 Jul 2025
- Ted Demopoulos
Dropzone AI Can Make Internal SOC Teams More Effective
Research PaperIn this paper, SANS Certified Instructor Mark Jeanmougin examines how Dropzone AI can integrate into existing security stacks and help SOC teams stay focused on high-impact decisions.
- 17 Jun 2025
- Mark Jeanmougin
SANS 2025 CTI Survey Webcast & Forum: Navigating Uncertainty in Today’s Threat Landscape
Research PaperThis paper explores results from the SANS 2025 CTI Survey, with insights into how cybersecurity...
- 20 May 2025
- Rebekah Brown, Andreas Sfakianakis
AI-Driven Insecurity: Assessing Security Gaps in AI Generated IT Guidance
Research PaperThe increasing reliance on AI-generated technical guidance for IT system configuration introduces significant security risks. This study assesses these risks through a case study: setting up an Apache web server on a Rocky Linux system using instructions from seven AI models.
- 13 May 2025
Validating the Effectiveness of MITRE Engage and Active Defense
Research PaperThis research examines the impact of Active Defense compared to a traditional security posture when an adversary employs common tactics and techniques to identify high-value targets or exfiltrate sensitive data.
- 29 Mar 2025
Shift Left the Awareness and Detection of Developers Using Vulnerable Open-Source Software Components
Research PaperThe research presented in this paper demonstrates that companies can shift the detection and awareness of developers using vulnerable components left in the early development stages.
- 26 Mar 2025
ARMO’s Behavioral Cloud Application Detection and Response (CADR) Platform
Research PaperThis paper explores how ARMO Platform is attempting to solve the challenge with the industry’s first behavioral cloud application detection and response (CADR) product.
- 18 Mar 2025
- Moses Frost
ASPM: Understanding the New Application Security Landscape
Research PaperMalicious actors continue to prey on the challenges of rapid software development cycles and cloud computing adoption. This paper examines where an application security posture management (ASPM) solution comes in.
- 18 Mar 2025
- Chris Edmundson, SANS Institute
Strolling Through the STIG
Research PaperThis research demonstrates how a new tool, Stroll, avoids the additional hardware requirements by living off the land.
- 7 Mar 2025
2025 ICS/OT Cybersecurity Budget: Spending Trends, Challenges, and the Future
Research PaperThis white paper explores the findings of the 2025 SANS Survey on ICS/OT Security Budgets.
- 3 Mar 2025
- Dean Parsons
Building Resilient IoT Devices: Binary Hardening with Yocto and Clang
Research PaperThis paper addresses the critical need for enhanced security in Internet of Things (IoT) devices by evaluating the implementation of binary hardening techniques using Clang security features within the Yocto build environment.
- 3 Mar 2025
Harnessing Entra ID Snapshots for Effective Post-Security Incident Detection and Containment
Research PaperThis research focuses on implementing identity snapshots within Microsoft's Azure Entra ID, demonstrating their potential to significantly enhance the efficiency and effectiveness of post-incident detection and containment.
- 3 Mar 2025
2025 SANS Detection Engineering Survey: Evolving Practices in Modern Security Operations
Research PaperTo dive deep into understanding the current state and future trends of this critical field, SANS has partnered with Anvilogic to conduct a comprehensive survey of Detection Engineering professionals across various industries. Dive into the findings in this whitepaper.
- 24 Feb 2025
- Terrence Williams
Identifying Advanced Persistent Threat Activity Through Threat-Informed Detection Engineering: Enhancing Alert Visibility in Enterprises
Research PaperAdvanced Persistent Threats (APTs) are among the most challenging to detect in enterprise environments, often mimicking authorized privileged access prior to their actions on objectives. Moving within the environment slowly and quietly, APTs can often persist within the environment for months before detection.
- 20 Feb 2025
Evaluating Modern Network Protocol Fingerprinting: Defending Bastion Hosts in Hostile Networks
Research PaperAdversaries continue to attack the network perimeter and trusted user workstations to gain access to sensitive networks. Modern networks are designed and often mandated to use encrypted communication paths everywhere.
- 6 Feb 2025