To protect vital data, enterprises and other organizations implement Transport Layer Security (TLS), commonly referred to as the superseded Secure Socket Layer (SSL), to encrypt data as it is exchanged over IP networks. But what is SSL decryption and how does it work? SSL/TLS creates a secure channel between the server and the end user's computer or other devices as they exchange information over the internet and different browsers.
TLS is an industry standard based on a system of trusted rules and certificates issued by certificate authorities and recognized by servers. SSL decryption was replaced by the TLS standard in 2015. In 2018, TLS 1.3 was standardized, which is a policy that mandates the use of perfect forward secrecy for maximum security. About 20 percent of corporate internet traffic is now on TLS 1.3.
While protecting data, encryption also blinds network security and application monitoring tools. TLS/SSL decryption traffic is crucial for these tools. However, it is extremely computationally intensive and can introduce network latency.
The best architecture minimizes the decryption required to inspect all relevant and active traffic while offering legal and privacy controls. The centralized approach to SSL decrypting offered by Gigamon — decrypt once and feed all tools — provides such an architecture.