By Matt Wilson, CISSP, Structured Senior Security Engineer —

Decrypting traffic during firewall inspection is essential for modern network security. It unlocks the full potential of next-generation firewalls (NGFWs), enhancing their ability to apply identity-based security controls and leverage advanced security features to protect against camouflaged threats.

Encrypted traffic, such as HTTPS, SSL, and TLS, makes up the vast majority of internet traffic around the world. In fact, the latest information from Google’s Transparency Report shows that as of Oct. 2024, 99 percent of pages loaded by Chrome were encrypted. This is good to help protect user data and privacy, as well as preserve data integrity. 

Unfortunately, encrypted traffic thwarts deep packet inspection (DPI). DPI can read the metadata (e.g., packet headers), but the payload is scrambled. This allows threat actors to:

• embed malware or botnets in normal web traffic,
• activate command-and-control (C2) communication,
• hijack traffic and launch man-in-the-middle (MitM) attacks, or
• deliver malicious updates to already-compromised systems.

By decrypting this traffic, firewalls can inspect data thoroughly, ensuring that harmful content and policy violations are detected and blocked.

Traffic Decryption and Identity-based Security Controls

Modern security practices often leverage identity-based policies to control access and enforce security measures. These policies use identity information to define access controls, making sure users can only access resources relevant to their roles.

When traffic is encrypted, it hides identity information, making it harder for firewalls to enforce these policies. Decrypting traffic allows firewalls to accurately identify users and apply the right policies, keeping access controls in place. This improves security and helps meet regulatory requirements with detailed identity-based logging and reporting.

Traffic Decryption and Advanced Security Features

By now, security teams at every single organization on the planet know they need to protect their network traffic using security devices like NGFWs. NGFWs offer many advanced security features like intrusion prevention systems (IPS), anti-malware protection, URL filtering, and application control.

But what many of these same security teams may not realize is that they are not taking proper advantage of their advanced security features if encrypted traffic is flowing by them. Encrypted traffic can’t be fully examined for malicious content.

This hurts on two fronts. First, the overall effect is weaker security. This is clearly bad. Second, and adding insult to injury, these advanced security features often require a paid subscription. Weaker security + wasted money = bad outcomes for business.

By decrypting traffic, companies can use all the features they have paid for, ensuring they get the most out of their security budget.

Traffic Decryption and the Resources Required for NGFWs

It is true that an NGFW can experience performance challenges when it manages decrypted traffic. Performing DPI and application identification on large volumes of traffic requires powerful CPUs, dedicated hardware, and – often – high availability or load-balancing. That said, with the right product and the right configuration, the negative impact to performance can be mitigated.

Here are six requirements to consider when scoping an NGFW for your environment:

1. Look for NGFWs that have dedicated hardware (ASICs or FPGAs) for handling SSL/TLS decryption.
   
2. Check the firewall’s SSL inspection throughput numbers, not just raw throughput, to ensure the firewall can handle the number of concurrent SSL sessions expected in your environment without introducing latency.
   
3. The firewall should support modern encryption standards like TLS 1.2 and TLS 1.3, but make sure the NGFW can also handle older SSL/TLS protocols if necessary.
   
4. Ensure the NGFW supports Perfect Forward Secrecy, an important security feature in modern TLS implementations.
   
5. Considering the prevalence of SaaS in modern business, your NGFW should integrate well with both on-premises and cloud environments, supporting traffic decryption across both domains.
   
6. And for all that this article discusses traffic decryption, your NGFW should allow you to define selective decryption policies based on traffic type, source, destination, or user. This will help ensure your organization remains compliant with privacy and security regulations like GDPR, HIPAA, or PCI-DSS.

Summary

NGFWs come with advanced security controls to fight modern threats. Features like sandboxing, deep packet inspection (DPI), and advanced threat protection (ATP) need to see the traffic content to work well. Encrypted traffic stops the firewall from analyzing the data within.

Decrypting traffic allows these controls to work fully. Sandboxing can test suspicious files, DPI can check data for threats, and ATP can find and stop sophisticated attacks. By decrypting traffic, companies can ensure their NGFW is ready to handle the latest threats, providing strong defense against cyberattacks.

Finally, companies spend a lot on NGFWs and their subscriptions, expecting full protection. Without decrypting traffic, they don’t get the full value of their investment. Decrypting traffic for firewall inspection is crucial because many of these advanced features are already included or paid for in NGFW subscriptions.

Ultimately, as cyber threats keep evolving, traffic decryption is a must for keeping networks secure and resilient.

About the Author