topic IPS support SSL encrypted threat protection in Network Security

IPS support SSL encrypted threat protection

moabdallah — Sun, 10 Mar 2019 10:20:11 GMT

Does Cisco IPS 4200 series support SSL encrypted threat protection ?

Regards

Mohamed

Re: IPS support SSL encrypted threat protection

mhellman — Wed, 22 Nov 2006 14:15:09 GMT

If you mean can the Cisco IPS store SSL private keys and decrypt sessions (for example, SSL sessions to your own web servers)....then no.

Re: IPS support SSL encrypted threat protection

moabdallah — Wed, 22 Nov 2006 21:16:45 GMT

I mean inspect the SSL traffic on the network

Regards

Mohamed

Re: IPS support SSL encrypted threat protection

mhellman — Wed, 22 Nov 2006 22:32:56 GMT

For any IPS to decrypt and inspect HTTPS traffic (I assume that's what you are really after) it would have to either:

1) have the necessary private keys ahead of time (like BreachView). For example, this would allow you to inspect traffic to your OWN web servers.

2) operate as a MITM, offering up fake SSL certs to the client. This is how many of the Content Filtering solutions are able to inspect user traffic that is encrypted. This would allow you to inspect user traffic.

Neither of these can be done with the Cisco IPS.

Re: IPS support SSL encrypted threat protection

moabdallah — Thu, 23 Nov 2006 09:38:31 GMT

What is the BreachView & MITM ?

Coudl you please send me any document explain this issue ?

I need the Cisco IPS 4255 to decrypt and inspect the SSL traffic

Regards

Mohamed Abdallah

Re: IPS support SSL encrypted threat protection

npham — Fri, 24 Nov 2006 18:25:34 GMT

Sorry if this sounds blunt or callous, but perhaps a bit more career development in the information security field is in order. If time is short, I suggest engaging a consultant or consulting firm which specializes in the infosec field to assist you in managing your expectations of a network security system.

MITM is an acronym for Man in the middle. I highly recommend a bit of GBT (Google Based Trainig). Here's a freebie.

http://en.wikipedia.org/wiki/Man_in_the_middle

You can read about Breach Security Inc. products here.

http://www.breach.com/products_breachviewssl.asp

Another free tip, be mindful of the privacy issues if you go down this path.