The most advanced security teams rely on network traffic as a fundamental data source, ground truth for security investigations, but encryption has made certain aspects of that truth increasingly difficult to obtain.
Decrypting the traffic would seem the obvious solution, but in many cases it’s not an optimal or even technically possible countermeasure.
Decryption can be cost prohibitive at scale, violate privacy policies or laws, or unacceptably degrade network performance.
In cases where organisations can’t decrypt traffic due to cost, performance, privacy regulations or technical limitations, open-source Zeek is the best tool for deriving insight from encrypted traffic.
