Threat Protections and SSL Inspection

[TheDroppedPacket]

I am currently assessing our IPS blade configuration and am wondering how much of a role SSL inspection plays in IPS Threat Protections. I would assume that Threat Protections without SSL inspection would be better than no Threat Protections at all but, is the inspection of encrypted traffic a major contribution to the effectiveness of Threat Protection? Thank you!

[Bob_Zimmerman]

It depends if you offer or use unencrypted services. For example, if you host an FTP site or if you access somebody else's, then IPS, threat emulation, and so on could see the traffic and provide some protection.

The overwhelming majority of traffic you are likely to care about is encrypted, though. Even DNS is moving towards encryption with DNS-over-HTTPS. If your traffic is encrypted, then you need SSL inspection to get any protection out of any of the deep inspection features. If the firewall can't see that the traffic is malicious, it can't respond to it.