Hi everyone, I'm pretty new to managing security at this level. We're looking at Cisco Firepower among other options, and I keep hitting a wall with this one question during my research.
Our company has strict privacy policies, and fully decrypting user traffic for inspection isn't really an option for us. I understand that's the gold standard for visibility. But I’ve read that Firepower and other NGFWs can still provide *some* insights into encrypted traffic.
My question is: what can I actually see without decryption? If I can't read the contents, what's left? Can it really tell me if something malicious is hiding in there, or is it just basic info like which website someone is visiting?
I'm trying to set realistic expectations for what we could achieve. Any practical examples from your experience would be incredibly helpful. Like, does it help with spotting malware callbacks or data exfiltration attempts, even if the payload is encrypted?
Thanks in advance for helping a newbie out 🙏
> "what can I actually see without decryption?"
I'm a data engineer, not a security pro, but I've been logging metadata from our internal network for a different project. Without decryption, you can still get:
- SNI (Server Name Indication) - tells you the domain, but not the full URL.
- IP addresses and ports.
- TLS version and cipher suite negotiation.
- Certificate info (who issued it, expiry).
- Packet sizes and timing patterns.
For spotting malware callbacks, the IP/domain reputation matters a lot. If a machine is talking to a known C2 server, the encrypted payload doesn't matter as much - you see the destination. Also, unusual traffic patterns (like a client uploading regular small encrypted packets at odd hours) can be a red flag.
I think Firepower's "encrypted visibility engine" tries to fingerprint the application or protocol through the TLS handshake. Like, it can tell if it's a normal web browser versus a bot using a custom TLS stack. That's kind of clever.
But for data exfiltration? If someone sticks a file in HTTPS and uploads it to Google Drive, you won't see the file name or size. You'd just see "connection to drive.google.com". So it's limited.
Have you looked into Cisco's "Encrypted Traffic Analytics" (ETA) feature? It's supposed to use machine learning on the metadata. No idea if it's actually any good though.
You can't spot malware in encrypted traffic without decrypting, full stop. All you get is metadata.
That IP/domain reputation idea is fine for the low hanging fruit, but modern attackers aren't using known bad domains. They're using legit cloud services with valid certs. Good luck spotting that.
Timing and size patterns? Those are academic papers, not reliable detection methods in a noisy production network.
Trust but verify.
Oh that's a tricky one with strict privacy rules. I get the feeling - I manage reports and dashboards, and sometimes you just can't see the raw data, you know?
You asked for practical examples. One thing I've heard is that you can still spot weird patterns, like a machine suddenly sending a ton of encrypted data late at night when no one's working. In a spreadsheet, it's like seeing a huge, unexplained spike in a traffic log.
But is that enough to catch something clever? I'm curious too.
You're right to focus on realistic expectations. Without decryption, you're limited to metadata and patterns.
Practical example from my side: we use this to find overprovisioned services, not malware. A pod suddenly sending 10x the encrypted traffic to an external IP can be a bug or a crypto miner. You can't see the payload, but the volume spike and destination are clear. It flagged a misconfigured job for us once.
But that's for resource abuse. For actual malware detection, metadata alone is a weak signal. It might catch something obvious, but a sophisticated attack using a common cloud service will look normal.
null
You've set realistic expectations for yourself, which is more than I can say for most vendors. What you'll get without decryption is essentially a glorified network traffic log with some threat intelligence sprinkled on top. You'll see where people are going and how much they're talking, but not what they're saying.
Yes, you can sometimes spot a crypto miner because it's chatty with a mining pool. Spotting actual data exfiltration or a clever malware callback? That's the vendor's fantasy land. If the malware uses a common CDN with a valid cert, your box will give it a gold star and wave it through.
Frankly, you're buying a very expensive way to discover you have overprovisioned services. For the price of that Firepower subscription, you could hire an intern to stare at netflow graphs.
Buyer beware.