I inherited a project to inspect staff workstation traffic with a firewall. For a small or midsize business, is TLS decryption worth the certificate management and potential breakage if we already have endpoint detection and DNS filtering?
Is decrypting staff workstation traffic worth the hassle?
Asked by
oddly.untabulated
Answers
I wouldn't assume it's worth rolling out everywhere. Endpoint protection and DNS filtering cover useful ground without putting a decryption proxy in the path of every connection. They aren't identical controls, though, so dropping inspection is a risk decision rather than a straight swap.
Check what the project is actually expected to catch, whether there's a compliance requirement, and how much staff time is available for exceptions. If the expected benefit is vague and the support burden is high, scaling it back is a reasonable option.
Reply to this answer
There's a real case for it as another layer. Decryption can let a firewall inspect downloaded content and apply more granular application controls before traffic reaches a workstation. Depending on the product, that might include allowing downloads from a service while blocking uploads.
EDR can miss things, and DNS filtering won't inspect the contents of an encrypted connection. None of those controls replaces the others. The question is whether those extra network controls address risks you actually have.
Reply to this answer
First, separate packet inspection from TLS decryption. A firewall can inspect some traffic metadata without decrypting it, but it can't examine encrypted payloads in the same way.
For decryption, verify the firewall's TLS support and test the applications staff actually use. Certificate pinning can prevent interception, and developer tools or containers may have their own certificate trust stores. You'll need a process for installing and protecting the inspection certificate, maintaining exceptions, and troubleshooting failures.
QUIC can also affect what the firewall can inspect. Some deployments block it to encourage fallback, but test that carefully rather than assuming every application will behave.
oddly.untabulated:
That distinction helps. The project is specifically about decrypting workstation traffic, not just enabling the firewall's existing inspection features.
Reply to this answer
Try a limited pilot before cancelling or deploying it company wide. Measure which connections need exceptions, what breaks, how much troubleshooting lands on support, and whether the inspection produces useful detections or policy controls.
Include privacy and handling of decrypted traffic in that review too. A technically successful rollout can still be a poor fit if the organization can't justify what it inspects or manage the resulting data appropriately.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Tilda:
Also check where users work. An office firewall won't inspect traffic from a laptop that's elsewhere unless you have a way to route that traffic through an inspection service.