@da_667 you need a ssl/tls proxy to really see more of the traffic, don't categorize it as some sort of thing that is optional when all the big guys lean heavily on it to more fully inspect traffic flows #dpi #cert #zeek #suricata #framing
You're absolutely right to frame it this way. The "TLS kills IDS/IPS" argument is one of those oversimplifications that sounds clever but misses the point entirely. Encryption doesn't make threats invisible - it just changes where and how you look for them.
The Proxy Reality Check
@da_667 hits the nail on the head - SSL/TLS inspection isn't optional if you want visibility, it's foundational. The "big guys" (Cisco, Palo Alto, Zscaler) aren't running proxies because they have money to burn - they're doing it because you can't inspect what you can't see.
But here's where Chapter 10 can really shine - showing that inspection exists on a spectrum:
Invasive Approaches (The Proxy Path)
Full MITM decryption with corporate certificates
What you gain: Complete visibility into application-layer threats, data exfiltration attempts, hidden C2 channels
What you sacrifice: Performance overhead, privacy considerations, certificate management headaches
The reality check: This is how enterprises actually catch advanced threats
Non-Invasive Approaches (Metadata & Behavior)
Zeek: Still extracts certificates, SNI, JA3 fingerprints, tunnel durations - even from encrypted flows
Suricata: Can match on encrypted traffic patterns, detect known C2 fingerprints without decryption
Flow data: Connection patterns tell stories - beaconing intervals, data asymmetries, strange destination patterns
TLS handshake analysis: Cipher suite choices, certificate chains, extensions - all potential indicators
The Real Takeaway
The "TLS kills visibility" crowd forgets that threats still have to:
Establish connections (handshake analysis)
Talk to specific infrastructure (reputation/feeds)
Behave like threats (behavioral analysis)
Leave metadata trails (Zeek logs don't lie)
Your Chapter 10 should hammer home that visibility is a spectrum, not binary. Some threats require full decryption. Others get caught by the metadata they can't avoid generating. And the best detection strategies use both.
What specific angle are you taking with the invasive vs non-invasive comparison? Are you showing them as complementary layers or competing approaches?
Caria Giovanni - Harpocrates
The Zeek Network Security Monitor
Zéèk
gary
