Sr. Systems Analyst at a manufacturing company with 5,001-10,000 employees
Real User
2020-06-22T13:49:50Z
Jun 22, 2020
I am a proponent of SSL inspection, as long as you have another function/service that is evaluating that traffic like URL filtering or DLP. The biggest reason I have seen is that all sites are going to https, so there is no granularity for URL filtering unless you are doing SSL inspection. Most URL filtering can categorize based on the full URI, but without SSL inspection you will only see the base. Example, without SSL your services will only see "www.itcentralstation.com" going to this page. With SSL inspection you will see the full URL, "www.itcentralstation.com giving the URL filtering service more information to categorize. Another good example are blog sites. without the SSL inspection, all the blogs look the same, with inspection the ones that you want to block can be identified.
Where not to use SSL inspection, in personal related destinations like health, banking and sites that fall into similar HIPA and PII categories.
One thing you will run into with SSL inspection is that some sites, especially security related sites, will have issues with the "man in the middle" generally used for SSL inspection, so you will run into issues where you have to bypass sites like this as well.
Search for a product comparison in Data Loss Prevention (DLP)
Security Manager at a transportation company with 1,001-5,000 employees
Real User
2021-08-16T08:28:14Z
Aug 16, 2021
SSL inspection requires high firewall resources, the use depends on what your objectives are. E.g., the SSL inspection is a must on WAF or Layer-7 IPS to protect inbound traffic to your servers,if you need very granular access control for your user to the Internet.
On the other hand, explicit proxy deployment can achieve the URL/URI filtering purpose without SSL inspection for client outbound traffic protection. While SSL inspection is useless for layer-4 only firewall/IPS and webserver running TLS 1.3, DLP/sandbox in endpoint seems to be more effective than the network approach, because the delay in scan result will timeout the network connection.
Consider SSL inspection on specific traffic types: it can save cost and settle the internal controversy.
As more Internet traffic is encrypted each day at some point the majority of Internet traffic will be encrypted. SSL inspection is needed when a business needs to audit what their users are doing on the Internet. Cost and complexity are the largest reasons to not perform SSL inspection, especially on the network edge.
I'm not a huge proponent of performing SSL inspection at the network edge. Most solutions performance levels drops off the face of the planet when enabled and it is complex to setup and maintain. I think the better solution for SSL inspection is to perform it on endpoint devices. This will be cheaper and less complex overall and provide SSL inspection on laptops even when they are not in the office.
Chief Technology Officer at a tech services company with 51-200 employees
User
2020-06-22T14:51:19Z
Jun 22, 2020
SSL Inspection is great for corporate/organizational security as it allows you visibility into the traffic going across the network. It can also break access to some sites as it is technically a man-in-the-middle. (Anything requiring certificate authentication.) If you're going to do it, you really need a login banner for your systems that advises users that their activities are being monitored. You'll also need to install certificates on people's PC's. This won't work for guest users. I wouldn't store decrypted content though as you will have to safeguard that data as it will contain sensitive information. (Is it really worth the risk?)
IT Support and Network Admin at Escuela Carlos Pereyra
User
Top 5
2020-06-23T13:56:41Z
Jun 23, 2020
These days you should use it no matter if you are a home user, it is about security, and it will be easier each time to have leaked on your personal or professional info, a serious IT guy always should say you should use it.
I used to be against this but leaning the other way now since just about every site is encrypted. I think some sites need to be avoided like banking, credit card processing, payroll, etc. Management, and especially the Accounting Dept needs to be in the loop.
SSL Inspection or HTTPS Inspection is the process of intercepting SSL encrypted internet communication between the client and the server. The interception can be done between the server and the client and vice-versa, SSL Inspection intends to filter out dangerous content, such as malware. This inspection is also called Deep SSL Inspection or Full SSL Inspection. It allows the user to do web and email filtering, antivirus scanning, etc.SSL inspection not only protects you from attacks that use HTTPS, but also from other commonly used SSL-encrypted protocols, such as SMTPS, POP3S, IMAPS, and FTPS.
For large companies SSL Inspection is often problematic, especially with the release of TLS 1.3 which is resistant to man in the middle attacks which is what SSL Inspection is in essence. The financial services industry fought long and hard to prevent the TLS 1.3 standard from blocking MiTM attacks since they depend heavily on it. The solution for TLS 1.3 is to use large terminating proxies to terminate the connections on either side of the conversation on PCs they wholly control.
A better approach is to scan for content prior to (or after) encryption which means a host agent on your users' machines.
Overall, i believe SSL Inspection is a losing battle as more sites adopt TLS 1.3 and more sites will break as the result of trying to use that technology unless you need to tightly control all communications. Consider the culture of companies that allow people to bring their own machines (BYOD) and are more collaborative in nature with guest/partner/vendor machines allowed on their networks. Does you company value stringent security or security that does not get in the way?
What is data loss prevention? Data loss prevention (DLP) is a solution or process used to prevent data breaches and ensure that sensitive data is not lost, accessed by unauthorized users, or otherwise misused.
I am a proponent of SSL inspection, as long as you have another function/service that is evaluating that traffic like URL filtering or DLP. The biggest reason I have seen is that all sites are going to https, so there is no granularity for URL filtering unless you are doing SSL inspection. Most URL filtering can categorize based on the full URI, but without SSL inspection you will only see the base. Example, without SSL your services will only see "www.itcentralstation.com" going to this page. With SSL inspection you will see the full URL, "www.itcentralstation.com giving the URL filtering service more information to categorize. Another good example are blog sites. without the SSL inspection, all the blogs look the same, with inspection the ones that you want to block can be identified.
Where not to use SSL inspection, in personal related destinations like health, banking and sites that fall into similar HIPA and PII categories.
One thing you will run into with SSL inspection is that some sites, especially security related sites, will have issues with the "man in the middle" generally used for SSL inspection, so you will run into issues where you have to bypass sites like this as well.
SSL inspection requires high firewall resources, the use depends on what your objectives are. E.g., the SSL inspection is a must on WAF or Layer-7 IPS to protect inbound traffic to your servers,if you need very granular access control for your user to the Internet.
On the other hand, explicit proxy deployment can achieve the URL/URI filtering purpose without SSL inspection for client outbound traffic protection. While SSL inspection is useless for layer-4 only firewall/IPS and webserver running TLS 1.3, DLP/sandbox in endpoint seems to be more effective than the network approach, because the delay in scan result will timeout the network connection.
Consider SSL inspection on specific traffic types: it can save cost and settle the internal controversy.
As more Internet traffic is encrypted each day at some point the majority of Internet traffic will be encrypted. SSL inspection is needed when a business needs to audit what their users are doing on the Internet. Cost and complexity are the largest reasons to not perform SSL inspection, especially on the network edge.
I'm not a huge proponent of performing SSL inspection at the network edge. Most solutions performance levels drops off the face of the planet when enabled and it is complex to setup and maintain. I think the better solution for SSL inspection is to perform it on endpoint devices. This will be cheaper and less complex overall and provide SSL inspection on laptops even when they are not in the office.
SSL Inspection is great for corporate/organizational security as it allows you visibility into the traffic going across the network. It can also break access to some sites as it is technically a man-in-the-middle. (Anything requiring certificate authentication.) If you're going to do it, you really need a login banner for your systems that advises users that their activities are being monitored. You'll also need to install certificates on people's PC's. This won't work for guest users. I wouldn't store decrypted content though as you will have to safeguard that data as it will contain sensitive information. (Is it really worth the risk?)
In general, there are some vulnerabilities in SSL that you should try to mitigate whenever possible. SSL inspection should help indeed.
These days you should use it no matter if you are a home user, it is about security, and it will be easier each time to have leaked on your personal or professional info, a serious IT guy always should say you should use it.
I used to be against this but leaning the other way now since just about every site is encrypted. I think some sites need to be avoided like banking, credit card processing, payroll, etc. Management, and especially the Accounting Dept needs to be in the loop.
SSL Inspection or HTTPS Inspection is the process of intercepting SSL encrypted internet communication between the client and the server. The interception can be done between the server and the client and vice-versa, SSL Inspection intends to filter out dangerous content, such as malware. This inspection is also called Deep SSL Inspection or Full SSL Inspection. It allows the user to do web and email filtering, antivirus scanning, etc.SSL inspection not only protects you from attacks that use HTTPS, but also from other commonly used SSL-encrypted protocols, such as SMTPS, POP3S, IMAPS, and FTPS.
We don't use it yet - but I am exploring my options here. I believe its the only way to identify exactly whats coming into the workspace
For large companies SSL Inspection is often problematic, especially with the release of TLS 1.3 which is resistant to man in the middle attacks which is what SSL Inspection is in essence. The financial services industry fought long and hard to prevent the TLS 1.3 standard from blocking MiTM attacks since they depend heavily on it. The solution for TLS 1.3 is to use large terminating proxies to terminate the connections on either side of the conversation on PCs they wholly control.
A better approach is to scan for content prior to (or after) encryption which means a host agent on your users' machines.
Overall, i believe SSL Inspection is a losing battle as more sites adopt TLS 1.3 and more sites will break as the result of trying to use that technology unless you need to tightly control all communications. Consider the culture of companies that allow people to bring their own machines (BYOD) and are more collaborative in nature with guest/partner/vendor machines allowed on their networks. Does you company value stringent security or security that does not get in the way?