RE: How to monitor encrypted connections...

["Ofer Shezaf" <OferS () Breach com>]

There are basically three ways to monitor SSL traffic:

+ Terminate at the edge of the network and connect your IDS to the
cleartext segment. While trivial, this is the most common solution. The
disadvantages are of course:
        (a) Decrypting early, requiring your data to flow through part
of your network unencrypted.
        (b) Need for an additional device to decrypt SSL at the edge.

+ SSL Bridge - terminate and then re-encrypt. Works only for an in-line
device and might validate non-repudiation.

+ Passively decrypt - decrypt a copy of the traffic, without actually
being part of the conversation. This one is the best add on for existing
IDS systems (*SAMELESS PLUG* we sell such an add on)

~ Ofer


Ofer Shezaf
ofers () breach com, Phone:+972-9-9560036 #212, Cell: +972-54-4431119

CTO, Breach Security; 
Chair, OWASP Israel; 
Leader, ModSecurity Core Rule Set Project

> -----Original Message-----
> From: listbounce () securityfocus com
> [mailto:listbounce () securityfocus com] On Behalf Of Jean-Pierre
FORCIOLI
> Sent: Wednesday, September 19, 2007 7:23 PM
> To: focus-ids () securityfocus com
> Subject: How to monitor encrypted connections...
>
> Hi,
>
> Still working on my IDS/IPS project...
> When browsing some IDS/IPS vendors' datasheets, I noticed that some of
> them
> claimed being able to monitor encrypted traffic.
> Could someone provide me with some insight on what is currently
> possible (and already
> implemented) and what are the eventual limitations?
>
> Best regards.
-----------------------------------------------------------------------
> -
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it
> with real-world attacks from CORE IMPACT.
> Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campai
> gn=intro_sfw
> to learn more.
-----------------------------------------------------------------------
> -


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------