What is TLS Inspection

The Need for TLS Inspection

In recent years, the proportion of Internet traffic using encrypted HTTPS has grown dramatically, providing significant privacy and security benefits. However, one of the swiftest-growing types of encrypted traffic is malicious traffic, which uses SSL/TLS to hide from network security tools.

TLS inspection is necessary to identify malware command and control (C2) traffic, attempted data exfiltration, and other malicious traffic on a company’s network. By stripping away the protection provided by SSL/TLS, corporate network security solutions can identify and block threats at the network level.

Benefits of TLS Inspection

TLS inspection provides a few benefits for an organization, including:

• Enhanced Security: TLS inspection enables an organization to identify malicious content in encrypted network traffic. By blocking malware communications or attempted exploitation of vulnerable software, it enhances the company’s overall security posture.
• Policy Enforcement: SSL/TLS encryption can permit violations of corporate security policies, such as browsing unapproved websites. TLS inspection enables an organization to perform URL filtering and enforce its security policies.
• Regulatory Compliance: Data privacy laws mandate that companies protect and control access to sensitive information. TLS inspection allows organizations to identify and block attempted theft of sensitive customer or company data.

Best Practices for Configuring TLS Inspection

Some best practices for configuring TLS inspection include the following:

• Inbound vs. Outbound Inspection: Inbound and outbound traffic carry different potential risks to the business. Companies can configure one or both based on a device’s role in the organization and the type of threats that it is looking to manage.
• Respect Privacy Concerns: Under PCI DSS, HIPAA, GDPR, and similar laws, an organization may have no need or right to inspect certain types of data (PII, PHI, etc.). TLS inspection should be configured to skip traffic to sites such as financial institutions, healthcare providers, etc.
• Bypass List: Some websites may be trusted by the organization, and traffic to these sites doesn’t require inspection. Configuring TLS inspection to ignore these sites avoids potential network latency.
• Proxy Certificate: Importing a proxy certificate on company-owned devices enables encrypted connections between them and the gateway and eliminates in-browser warnings for users. Doing so enhances the user experience and can improve network security.