[Survey] Encrypted Traffic Visibility

Name

Organization

Email address

Choose all of your solution categories: Select all that apply

For enterprises
For telecoms

Policy control (e.g. BSS, mediation, charging, policy)

Traffic management (e.g. SD-WAN, NAT, EPC, vEPC, 5G UPF, routers, switches, load balancers, traffic forwarding, network optimization, content optimization)

Network security / fraud / revenue assurance (e.g. SASE, SSE, IPS / IDS, DLP, NGFW, ZTNA, SIEM, endpoint security, CASB)

Analytics (e.g. IP probes, network analytics, APM, DEM)

Network performance management / service assurance (e.g. OSS, QoS)

Are you aware of the latest encryption protocols? (e.g. TLS 1.3 and DNS-over-X)

Yes

No

What benefits do you see from the LATEST encryption protocols?

No
benefit
Mild
benefit
Moderate
benefit
Significant
benefit

Secure traffic authentication and improved data confidentiality / integrity

Faster transmission / lower latency for encrypted traffic

Spurring new class of applications previously restricted by data security concerns

Secure remote working

Regulatory compliance (e.g. HIPAA, PCI-DSS or GDPR)

Enhanced cloud security

Loss of traffic visibility from new encryption protocols is a major concern for today's networks. Do you agree?

Yes

No

Which information layers are most impacted by encryption?

No
impact
Mild
impact
Moderate
impact
High
impact

Application type information (e.g. Netflix / Facebook) and performance (e.g. packet rate)

Service type information (e.g. video streaming / file download) and performance (e.g. packet loss)

Malware and threats information

Packet payload information

Degree of compliance (e.g. SSL / TLS certificate compliance for server identity)

Rank the protocols that affect network visibility the most The top causing the highest loss in network visibility

TLS 1.3

TLS 1.3 0-RTT

ESNI

ECH

QUIC

DNS-over-HTTPS

DNS-over-TLS

DNS-over-QUIC

How has encryption impacted the effectiveness of the networking functions you offer?

We don't
offer this
solution
No
effect
Mild
effect
Moderate
effect
Significant
effect

Policy control (e.g. access management, user authentication)

Traffic management (e.g. routing, steering, content optimization, load balancing)

Security (e.g. threat detection, content filtering, fraud and abuse prevention)

Analytics (e.g. probing, real-time traffic analysis, application monitoring, digital experience monitoring)

Network performance management / service assurance (e.g. ensuring QoS, identifying network issues)

How does the loss of traffic visibility (due to encryption) impact network outcomes?Select all that apply

Poor traffic performance and high latencies

Higher network costs

Poor network decisions and design

Inability to execute SLA-based plans

Lack of support for critical applications

Inability to identify and curtail threats / abuse / fraud

What % of security incidents you experience can be attributed to encrypted threats?

None
20%
40%
60%
80%
Almost all

Do you plan on integrating visibility into encrypted traffic intelligence into your solution?

Yes

No

Select all the tools you use to monitor encrypted trafficSelect all that apply

None

Tools that decrypt traffic for inspection

More info

TLS Inspection / Middleboxes / MiTM / SSL/TLS proxy server / HTTPS Interception

Tools based on behavioural and statistical / heuristic analysis

More info

Includes metadata analysis, packet level data such as packet sizes, packet rates and interpacket delay; flow data such as traffic direction initiated by the protocol and/or app and number of flows; and statistical information such as mean, median, variation and entropy.

Tools based on machine learning and deep learning

More info

Deploying algorithms such as k-nearest neighbors (k-NN), LSTM, decision tree learning, CNN, RNN.

Other tools:

What are some of the issues you face with TLS inspection tools in monitoring encrypted traffic?Select all that apply

Security (e.g. exposure of plaintext data in TLS chains)

Regulatory (e.g. laws prohibiting decryption of sensitive applications)

High resource utilization and high latencies

Incompatibility with certain applications leading to connection failure

Incompatability with new protocols (e.g. TLS 1.3)

Limited functionalities (e.g. inability to bypass applications with encrypted SNI / certificate SAN)

Configuration complexities (e.g. setting up forward proxies, certificate authorities and cipher suites)

An ideal tool for encrypted traffic inspection should have the following capabilities:

Not
required
Mildly
important
Moderately
important
Highly
important

Ability to process unlimited traffic flows with an efficient memory and CPU utilization

Accurate identification of traffic / applications which use latest encryption protocols (e.g. TLS 1.3)

Granular identification down to service types (e.g. video vs messaging)

Ability to identify obfuscated traffic (e.g. tunneling)

Ability to identify anonymized traffic (e.g VPNs / proxies)

Support for future encryption methods / protocols

Seamless integration into existing network architecture

Are you currently using deep packet inspection (DPI)?

Does the DPI have visibility into encrypted traffic?

Yes

No

Do you plan on integrating encrypted traffic intelligence into your DPI?

Yes

No

Do you plan on using DPI in the future?

Will you require your DPI to have encrypted traffic intelligence?

Yes

No