All right. Think about this from a bad guy's perspective.
We've been talking about how our edge is capable of performing IPS and AMP
analysis because what we're talking about is we're talking about a client
reaching out to a server and analyzing this traffic in the middle,
basically saying, Hey, you're running right through this edge device.
And so why not go ahead and analyze it? So again,
think about this from the perspective of the threat actor.
We want to bypass something as powerful as IPS and AMP.
How would we go about doing it?
And they do have a very simple and clever way of doing this,
or maybe it's not so clever anymore. I don't know.
But it's simply to say, let's go ahead and use encrypted traffic.
What if we deployed encryption via something like HTTPS?
So I have successfully gotten the user to click this bad link.
And this bad link maybe through a phishing attempt or something along those
lines has now directed the host to reach out to the server again via HTTPS.
Well now all of a sudden this traffic flow is encrypted.
So I'm sending the file down,
we're downloading the file and I can no longer perform my analysis for IPS and
AMP because I can't look into the encryption.
That is going to be a little bit of a difficult aspect to me trying to run
analytics. So what is the solution to this? Well, again,
I started off this conversation by saying, let's think like a threat actor.
Let's keep thinking like a threat actor.
What if we were to do something a little bit interesting?
So first and foremost, Cisco is not going to claim to be a threat actor here.
We're just going to develop a solution,
which is known as SSL and TLS proxy.
But here's the fun part.
We're basically going to play the role of a threat actor and we're going to
perform a what's known as a man in the middle attack.
A man in the middle attack is when a threat actor sits in the middle of a
communication,
usually between a host and like a network switch or an access point or something
like that and basically gets to see all of the traffic that's going back and
forth. And so if you think about it,
that's exactly what we need to accomplish here.
We need to be able to see all of the traffic that's going back and forth.
So let's go ahead and do our best threat actor.
What's the word I'm looking for? Imitation.
Threat actor imitation and perform this attack, so to speak.
Now I'm going to use air quotes because it's not really an attack.
Essentially what we're doing is saying we need to analyze that traffic.
So we're going to decrypt it. So here's how this works. Again,
our edge is sitting in the middle.
Our host has reached out and it's going to send what's known as a client hello
message as part of the initial communication with the server.
Again, we're assuming that this is a bad guy server,
but it could also be a good server. Either way, it doesn't matter.
They're going to send a hello or client hello message.
And then this is going to send back a server hello message,
which is going to trigger for us everything that we're about to do.
Normally what happens is these two devices are going to form keys and sign
certificates and make sure that we have a secure end to end connection.
Instead, what we're going to do is we're going to,
let me draw it down here. So now we've got our keys here.
Instead we're going to form keys here and here and form a secure connection this
way and form a secure connection this way.
We're performing an interception of this communications and we're going to more
or less pretend that we are one of these devices or the other,
depending on who we're talking to. As a result,
we are going to get that TLS communication back and forth or SSL really in
modern networks. We don't use SSL very often.
TLS is basically upgraded SSL sort of SSL plus and this is what we use these
And now because I get the traffic through an encrypted tunnel and I am able to
decrypt it, I'm now able to run my analytics. Let's do it like this.
So we send our traffic and we get decrypted here and then we can run the
analysis of the traffic. So again,
my IPS or my amp,
I'm able to look at the unencrypted traffic and then I re encrypt it and I send
it down. So it's only ever decrypted here on the edge itself.
As long as it's in flight or really being sent through network devices,
it's always still encrypted.
And so my analysis is the only part of this process that gets to see the
traffic in an unencrypted state.
Now there is a little bit of configuration that we have to do when we're
putting this out in the environment besides just enabling it.
Specifically, we're going to have an option of three different policies.
I can have a do not decrypt policy
and as the name implies,
we're not going to use these proxy tunnels.
We're basically going to disable this or we can set up to decrypt and this means
that we are using the proxy tunnels in order to see the traffic in the middle or
we can simply drop this traffic. Now this policy,
whichever one we choose,
this can be based on our match concept.
So we match traffic based on the criteria that we choose and we apply the policy
based on that. So some traffic,
let's say traffic A might get a decrypt policy, say, Hey,
we're going to run our analytics against it. Traffic B type,
we're just going to outright drop this traffic because we don't trust it for one
reason or another. If there is a known good device out here,
so we've got this known good server,
maybe it's a server in our own environment and we want to trust it and it's
very important that we, for compliance reasons, don't look into that traffic.
Then we also have this do not decrypt option as well.
So what's interesting here is how does this edge respond to that?
How does it figure it out? Well, it has to do with this client.
Hello message. The client hello message comes into the edge and actually let's
draw this down here.
So the edge device is going to receive the client hello message and it's going
to hand it off to the UTD process running on the edge.
The UTD process looks at this match,
looks at the policy and then decides what to do with it.
And so that sets the policy, right? One, two or three.
And then potentially probably it's going to send the traffic on and allow that
client hello message to get out to its destination.
So this client hello message is really what triggers this whole process,
allows us to respond appropriately. And again,
the key takeaway from this conversation is understanding that allows us to
basically fake encryption to both ends,
performing this man in the middle air quotes attack in order to allow me to
perform my IPS and AMP analytics or evaluation of the traffic that's being sent.