“If 80% of your network traffic is encrypted with TLS, your million-dollar Next-Generation Firewalls are acting as expensive layer-4 packet filters.”

In late 2016 at Wipro, our security audits revealed a critical vulnerability: legacy firewalls were passing outbound encrypted HTTPS traffic without inspecting payload contents.

The Inspection Dilemma

To detect malware C2 (Command & Control) callbacks hiding inside TLS tunnels, we deployed Palo Alto SSL Forward Proxy.

• SSL Forward Proxy: The firewall intercepts outbound client HTTPS connections, acts as a dynamic Intermediate Certificate Authority (CA), decrypts payload data for Threat Prevention inspection, and re-encrypts the traffic to the destination host.
• Privacy Exclusions: Traffic directed to Financial Banking (financial-services) and Healthcare (health-and-medicine) categories was strictly excluded from decryption to comply with privacy laws.

[!IMPORTANT] Failure to install the firewall’s Intermediate Root CA certificate in every corporate endpoint’s trusted store will trigger untrusted certificate warnings across every client browser.

# # Palo Alto PAN-OS SSL Decryption Exclusion Rule
set rulebase decryption rules "Exclude-Banking-Health" category [ financial-services health-and-medicine ] action no-decrypt

The Verdict

Key Takeaway

You Cannot Defend What You Cannot See.

Deploying SSL/TLS Outbound Decryption is mandatory for modern threat prevention. Ensure privacy compliance by creating strict exclusion categories for sensitive financial and medical destinations.