Question

A security engineer notices that the malware protection and intrusion policies on a Cisco FTD sensor are failing to detect threats in outbound HTTPS traffic to unknown websites, even though the same policies successfully catch threats in cleartext HTTP sessions. Application visibility (AVC) also shows most flows as 'SSL/TLS' with no deeper application identification. Which action should the engineer take to allow the deep inspection engines to examine the payload of these encrypted sessions?

Accepted Answer

Configure an SSL/TLS decryption policy using Decrypt - Resign so the FTD can inspect the plaintext of outbound sessions

Answer

Add a prefilter rule to fastpath the HTTPS flows so the Snort engine processes them without buffering

Answer

Enable TLS 1.3 support on the access control policy so the flows are automatically inspected in the clear

Answer

Switch the intrusion policy to the Maximum Detection base policy to increase signature coverage of encrypted traffic