Making the Case For Inspecting Corporate SSL Traffic

Balancing the user privacy concerns of SSL/TLS inspection against the risks of not inspecting encrypted traffic.

Almost every stakeholder I speak with these days, from enterprise security architect to CISO, wants to be able to inspect their organization’s encrypted traffic and data flowing between the internet, the corporate devices, and the end-users they are chartered to safeguard.

When asked about the primary drivers for wanting to enable SSL/TLS inspection, their top-of-mind concerns are:
 

• Lack of visibility – Upwards of 75% to 80% of our traffic headed to the internet and SaaS is SSL/TLS-encrypted
• Threats – We know that bad actors are leveraging SSL/TLS to mimic legitimate sites to carry out phishing attacks as well as hide malware downloads and command-and-control (C&C) activities
• Sensitive data – We know bad actors are using SSL/TLS encrypted channels to attempt to circumvent Data Loss Prevention (DLP) controls and exfiltrate sensitive data; our own employees may intentionally or unintentionally post sensitive data externally

With a pretty clear understanding of the risks faced by allowing SSL/TLS-encrypted traffic to go uninspected, one would assume that every enterprise has already taken steps to enable inspection, right? Well…not necessarily. There are two major issues to overcome in order to implement this initiative—one is a technical hurdle, the other is political.

The technical hurdle is essentially ensuring that your enterprise network and security architecture supports a traffic forwarding flow for both your on-prem and off-net roaming users. In other words, you need an active inline SSL/TLS inspection device capable of scaling to the processing load imposed by the 75% to 80% of your internet and SaaS-bound traffic that’s encrypted. In an enterprise network and security architecture in which all end-user traffic, even from remote users, flows through one or more egress security gateway stacks (choke points) of traditional hardware appliances, the processing load imposed in doing SSL/TLS interception dramatically reduces the forwarding and processing capacity of those appliances, as evidenced in recent testing by NSS Labs.

The capacity issue is critical because most enterprises would need to augment their existing security appliance processing and throughput capacity by at least 3x to enable comprehensive SSL/TLS inspection. This constitutes a significant re-investment in legacy security technology that doesn’t align with a more modern, direct-to-cloud shift in enterprise network and security architecture designs.

The second concern, and the primary topic of a recent whitepaper issued by Zscaler, is balancing the user privacy concerns of SSL/TLS inspection against the threat risks of not inspecting an enterprise’s corporate device internet traffic.

Some of the key considerations in the privacy vs. risk assessment, and the subsequent move to proceed with an SSL/TLS inspection policy, are as follows:
 

• An organization cannot effectively protect the end-user and the corporate device from advanced threats without SSL/TLS interception in place
• An organization will struggle to prevent sensitive data exfiltration without SSL/TLS interception.
• Organizations should take the time to educate their end-users why instituting an SSL/TLS inspection policy is a security safeguard and not a “big brother” control.
• Organizations should inform employees of the extent to which traffic will and will not be inspected. This should be defined as part of an acceptable usage policy for internet use on corporate-issued assets and this policy should be incorporated into employment agreements.
• Organizations should review this policy with in-house legal counsel, external experts, and any associated workers’ councils or unions, as well as giving careful consideration to regional data safeguard compliance frameworks like GDPR.
• Organizations should take the necessary steps to ensure appropriate safeguards are in place for the processing and storing of logs associated with decrypted transactions, such as obfuscating usernames.
   

For a more comprehensive review of how to navigate the security vs. privacy concerns and implement a successful SSL/TLS inspection campaign, take a look at the recent whitepaper that Zscaler has authored, Encryption, Privacy, & Data Protection: A Balancing Act.

Chris Young is a Sales Engineer at Zscaler