Almost every stakeholder I speak with these days, from enterprise security architect to CISO, wants to be able to inspect their organization’s encrypted traffic and data flowing between the internet, the corporate devices, and the end-users they are chartered to safeguard.
When asked about the primary drivers for wanting to enable SSL/TLS inspection, their top-of-mind concerns are:
With a pretty clear understanding of the risks faced by allowing SSL/TLS-encrypted traffic to go uninspected, one would assume that every enterprise has already taken steps to enable inspection, right? Well…not necessarily. There are two major issues to overcome in order to implement this initiative—one is a technical hurdle, the other is political.
The technical hurdle is essentially ensuring that your enterprise network and security architecture supports a traffic forwarding flow for both your on-prem and off-net roaming users. In other words, you need an active inline SSL/TLS inspection device capable of scaling to the processing load imposed by the 75% to 80% of your internet and SaaS-bound traffic that’s encrypted. In an enterprise network and security architecture in which all end-user traffic, even from remote users, flows through one or more egress security gateway stacks (choke points) of traditional hardware appliances, the processing load imposed in doing SSL/TLS interception dramatically reduces the forwarding and processing capacity of those appliances, as evidenced in recent testing by NSS Labs.
The capacity issue is critical because most enterprises would need to augment their existing security appliance processing and throughput capacity by at least 3x to enable comprehensive SSL/TLS inspection. This constitutes a significant re-investment in legacy security technology that doesn’t align with a more modern, direct-to-cloud shift in enterprise network and security architecture designs.
The second concern, and the primary topic of a recent whitepaper issued by Zscaler, is balancing the user privacy concerns of SSL/TLS inspection against the threat risks of not inspecting an enterprise’s corporate device internet traffic.
Some of the key considerations in the privacy vs. risk assessment, and the subsequent move to proceed with an SSL/TLS inspection policy, are as follows:
For a more comprehensive review of how to navigate the security vs. privacy concerns and implement a successful SSL/TLS inspection campaign, take a look at the recent whitepaper that Zscaler has authored, Encryption, Privacy, & Data Protection: A Balancing Act.
Chris Young is a Sales Engineer at Zscaler