Cisco SSL Inspection (SSLi) Bundles White Paper

 

Executive summary

The majority of internet traffic is encrypted to protect sensitive data from eavesdropping, theft, and manipulation. In recent years, the volume of internet traffic that is encrypted has risen from 50% in 2016 to over 90% in 2020. While data encryption is a critical technology for ensuring privacy and protecting confidential information, encryption increases security risks for organizations as they lose visibility into network traffic and attackers use encrypted traffic to launch cyberattacks.

Cisco and Radware partner to offer SSL inspection (SSLi) Bundles. SSLi Bundles offer Cisco^® Secure Firewall (formerly Cisco Firepower NGFW) customers and Web Security Appliance (WSA) customers scalable and effective options for inspection of encrypted traffic, dramatically reducing security risks.

SSL/TLS background

Secure Sockets Layer (SSL) is a widely used security technology that establishes an encrypted communications link, enabling sensitive information such as online banking transactions, credit card numbers, and login credentials to be securely transmitted over the internet. Even if the communication is intercepted, the data cannot be read because the information is encrypted.

Transport Layer Security (TLS) is the next generation of SSL secure transport. TLS helps protect web applications from data breaches and other attacks. It is mainly used to encrypt web communications, such as web browsers loading a website. HTTPS is an implementation of TLS on top of the HTTP protocol that ensures the privacy and security of web services.

Escalating attacks using encrypted data

The use of SSL/TLS has exploded in recent years as encryption is increasingly used to protect data and comply with security and data protection regulations. The Google Transparency Report noted that more than 90% of the pages loaded in Chrome were encrypted.[1]

90% and Growing

Percentage of encrypted traffic on Chrome

Fragment navigations, history push state navigations, and all schemes besides HTTP/HTTPS (including new tab page navigations) are not included.

Source: Google transparency report

The challenge

While data encryption is highly effective for protecting sensitive information, encryption creates serious blind spots and dramatically increases security risks because IT teams are unable to inspect traffic for malware and other malicious content that can be embedded in encrypted data.

Additionally, although modern security devices such as Cisco Secure Firewall and WSA have built-in SSL/TLS inspection capabilities, the performance of these devices can be severely impacted by SSL/TLS inspection, which places heavy demands on the processing power of security devices and can leave them vulnerable to exploit.

The solution: Cisco SSL inspection bundles

To address the growing need for the inspection of encrypted data, Cisco offers SSLi bundles, a scalable and cost-effective solution that provides visibility into encrypted traffic, reduces the attack surface, and allows customers to optimize their Cisco Secure Firewall and WSA security deployments.

Cisco SSL inspection bundles provide Secure Firewall and WSA customers with scalable and efficient options for offload and inspection of encrypted traffic. The SSL inspection bundles provide high availability, increased scalability, and granular privacy control of encrypted traffic protection while offloading SSL/TLS traffic processing from security devices.

Each bundle includes a front-and back-end Cisco Secure Application Delivery Controller (ADC)[2] for SSL inspection with user-privacy categorization subscription and support.

Cisco offers four (4) predefined SSLi bundles to simplify sizing/dimensioning and provide an optimized SSLi solution to meet every customer need.

Bundles are deployed in pairs for high availability and/or individually to scale gateway designs incrementally. These bundles simplify dimensioning because they are defined according to real-life encrypted IMIX bandwidth performance for this use case.

As a result, the bundles can be applied to any of the Cisco encrypted traffic inspection requirements without the need for special consideration of real-life traffic patterns and the SSL/TLS inspection capacity. Additional Cisco Secure ADC SKUs are available via the Cisco GPL.

SSL inspection bundle with front-and back-end Secure ADCs

Note:      A Secure URL subscription is only needed for outbound SSL/TLS inspection.

FEATURES – SSLi bundles

Flexible and simplified security service management

Cisco SSL inspection uses traffic profiles and policies to transparently steer traffic through the various security inspection servers in the chain. SSLi service chaining enables simplified security service provisioning and reduces the administrative tasks involved in service management and maintenance.

A single location for encryption policy enforcement with robust algorithm and protocol support

Cisco SSL inspection provides a central location where encryption policies can be enforced while ensuring that traffic is decrypted/re-encrypted only once. Organizations can comply with best practices and compliance requirements in one place, while providing support for modern standards and algorithms like TLS 1.3 and Elliptical Curve Encryption regardless of the lack of support in underlying all-in-one or standalone security services that will inspect the clear-text/decrypted traffic in the service chain. Not only does this provide predictable engineering and lower latency, it also provides consistency in execution for security organizations. Because SSL/TLS encryption is the focus for Cisco SSL inspection, you can rely on future-proof support for new protocols and algorithms as they emerge, instead of managing exceptions while differing underlying security services provide their implementations of these at different release cycles.

Inbound SSL Offloading or Known Key

In addition to HTTPS, Cisco SSL inspection provides SSL visibility for mail protocols (IMAPS, SMTPS, POP3S), FTPS, and generic TLS traffic.

It can also discover outbound SSL/TLS traffic on any TCP port addressing dynamic use cases.

Flexible deployment options

Cisco SSLi inspect can be implemented as a bump in the wire device, overseeing all of the organization’s traffic to and from the internet with virtual/physical separation between the DMZ and the enterprise’s internal network. Based on its advanced application classification capabilities, Cisco SSL inspection seamlessly intercepts and steers traffic to the various security solutions for in-depth inspection before allowing it to continue to its destination. The solution allows traffic steering to active inline devices as well as forwarding a copy of the traffic to out-of-path passive devices.

In addition to providing high-performance, hardware-based SSL/TLS decryption options, SSL inspect is available for deployment in distributed, virtual environments as a virtual appliance or NFV, or within IaaS environments (Microsoft Azure, Amazon Web Services, Google Cloud Platform, Alibaba Cloud, etc.) with industry-leading price/performance.

Furthermore, Cisco SSL inspection has a unique ability to connect to any type of value-add security service (VAS), including 1- or 2-leg solutions, L2 and L3 solutions, or out-of-path solutions that read network traffic in TAP mode.

SSL Inspection Deeper Dive

High-performance SSL decryption use case

Improved security solutions capacity

Cisco SSL inspection provides several capabilities, which improve the utilization of the enterprise’s security devices:

●     By steering only the relevant traffic to the security service for inspection, the load on that service can be controlled and reduced, enabling cost-effective sizing or elasticity.

●     SSL inspect enables redundant security inspection solution servers to operate in an active-active mode through persistent load balancing to increase the traffic inspection capacity of the entire deployed solution. This means that, to scale up, Cisco can apply additional bundles as needed to increase SSL/TLS capacity either for the first time or over time.

Advanced high availability

The unique deployment architecture of SSL inspect and its inherent load balancing capabilities enables it to scale each of the security service farms separately and thus ensure traffic will always flow through the most available element. Even in cases where service elements are down, Cisco SSL inspection provides a simple way to define a policy that decides whether to bypass to an unresponsive security service, ensuring continuous internet connectivity, or to block the traffic and avoid bypassing critical inspection services.

Outbound traffic management for complete privacy, increased security, and higher productivity

Cisco SSL inspection provides complete outbound traffic management based on an embedded URL classification engine. In cases where the employee is browsing sites with private personal information, such as consumer banking or healthcare, the privacy module automatically designates that session as private, avoids decryption, and bypasses all inspection servers and sends the traffic directly to its destination, ensuring user privacy.

In cases where decryption is not possible for technical reasons, such as applications with embedded or pinned public certificates, decryption can be administratively bypassed.

Additional benefits

As a smart centralized traffic steering solution, the SSL inspect, with its high-capacity SSL hardware engine, decrypts all relevant SSL encrypted traffic before forwarding it to the various security solutions and re-encrypts the traffic before forwarding it to the final destination. Offloading traffic decryption and re-encryption delivers the following key benefits:

●     Lower latency for all transactions, as traffic is only decrypted/re-encrypted once for all solutions and not by each security solution separately.

●     Reduced overall cost/performance by offloading CPU-intensive SSLi functions from security devices and leveraging purpose-built, industry-leading Secure ADC for scalable SSL inspection.

Challenges of SSL inspection with “All-in-One” security devices (sidebar)

●     SSL/TLS standards are constantly evolving and support for TLS 1.3, ECC, etc. is not always available in “all-in-one” solutions.

●     Configuration of traffic flows through multiple security devices is complex. It becomes even more challenging as each security device has its own requirements, certificate repository, and policies.

●     High availability is costly (often requires 1+1 redundancy), complex to configure, and often prone to human error.

●     Certificate management across a security gateway architecture is also difficult to maintain.

●     Performance and scalability are costly; users suffer from increased latency; security tools run out of capacity, often leading to forklifts to scale up.

Cisco Secure ADC technical specifications[3]

Summary

To address the growing need for the inspection of encrypted data, Cisco offers SSLi bundles, a scalable and cost-effective SSL/TLS offload and inspection solution that provides visibility into encrypted traffic and reduces the risk of cyberattacks delivered over encrypted data.

Cisco SSL inspection bundles provide Cisco Secure Firewall and WSA customers with scalable and effective options for offload and inspection of encrypted traffic. The SSL inspection bundles provide high availability, increased scalability, and granular privacy control of encrypted traffic protection while offloading SSL/TLS traffic processing from legacy security devices.

Learn more

Cisco partners with Radware to provide best-of-breed DDoS, WAF, SSL, ADC, and bot management solutions that enhance network resilience, ensure application availability, and protect digital enterprises worldwide.

To learn more, please visit:

Cisco.com cisco.com/go/secure

Cisco SSLi Bundles at-a-glance (AAG):
www.cisco.com/c/en/us/products/collateral/security/ssli-bundles-aag.pdf

Cisco Secure ADC data sheet:
www.cisco.com/c/en/us/products/collateral/security/secure-adc-alteon-ds.pdf Cisco

Secure ADC technical specifications:
www.cisco.com/c/en/us/products/collateral/security/alteon-technical-specs-ds.pdf

For questions about our solutions or for sales support, please contact
Cisco at www.cisco/com/c/en/us/buy.