Module 13 Using Decryption

Question 1

What are digital certificates used for?

Answer 1

Digital certificates used to authenticate the communication between end nodes.

Question 2

SSL and TLS help prevent what?

Answer 2

Data exfiltration and malware introduction

Question 3

What happens to inbound SSL traffic to the firewall?

Answer 3

Traffic is decrypted so it can be inspected by App-ID, Content-ID

Question 4

Why decrypt traffic?

Answer 4

Most web traffic is encrypted - but, we want to enforce decryption leaving the firewall and entering the firewall. This protects sensitive data from leaving and malicious content entering the network.
- enabling decryption includes preparing the keys and certs for decryption.

Question 5

SSL/TLS - how are digital certificates used. (6 steps)

Answer 5

Client requests SSL connection

Question 6

Step 2

Answer 6

SSL server sends server certificated (signed copy of public key). Cert contains its identity and public key.

Question 7

Step 3

Answer 7

Client verifies the server certificate, uses PKI (Public Key Infrastructure) to validate the server cert and public key.

Question 8

Step 4

Answer 8

As long as the server public key is good, client uses server public key to encrypt a symmetric session key. Then it is sent to the server. Client Sends encrypted copy of session key to server.

Question 9

Step 5

Answer 9

Server uses its own private key to decrypt the copy of the session key.

Question 10

Step 6

Answer 10

Both sides use the session key to encrypt comm for privacy

Question 11

What are the firewall decryption types

Answer 11

SSL Forward proxy (Outbound), SSL Inbound Inspection, SSH Decryption.

Question 12

Break——————————————————————————————-

Question 13

PKI

Answer 13

Public Key Infrastructure

Question 14

What is asymmetric

Answer 14

Two - public and private key. They are created at the same time, two mathematically related keys. Then you decide which is public and which is private.

Question 15

What is symmetric encryption

Answer 15

A single shared key, encrypt and decrypt with the same key.

Question 16

Public vs private key?

Answer 16

You give the public key to the world. Anyone can see this key, you give it away. Any website can encrypt data and send it your way. Your private key is the only one that can decrypt data.

Question 17

What is a public key certificate?

Answer 17

Binds a public key with a digital signature, includes other details about the key holder.

Question 18

What is a PKI digital certificate?

Answer 18

Method of packaging and distributing public keys in such a way that proves the identity of the owners.