Next-Generation Firewall Buying Criteria for Your Decryption Needs

1. Granularly choose what to decrypt: Privacy concerns and regulations require that your NGFW can selectively decrypt traffic based on criteria flexible enough to meet your needs. These criteria can #www.avg.com/activate include user; URLs; URL categories, such as finance or health; externally hosted URL lists to comply avg.com/activation with regulations; IP address-based source and destination Install Avg With License Number activation; ports; and protocols. To catch potential malware avg internet security, the firewall must also allow you to exclude applications from decryption avg.com/retail   when they are running on their default ports but continue to decrypt those same applications when they are detected on nonstandard ports.
   
2. 
   
3. Exclude applications that may break upon decryption: Application vendors sometimes use HTTP public key planing, also known as certificate pinning, to resist impersonation by attackers using wrongly issued or otherwise fraudulent avg internet security certificates. When this technique is used, network security devices may break some applications upon decryption. Your NGFW must allow you to exclude such traffic easily avg internet security by using hostname of the website or  #www.avg.com/activate application in the exclusion rule. If the NGFW forces you to define exclusions based on distinguished and common names of certificates, it is too complex. To make it even easier, the NGFW should ship with predefined exclusions for well-known applications that break upon decryption avg.com/activation.
4. 
   
5. Enforce certificate status: You may want to drop traffic for which the SSL certificate is expired, the server certificate avg.com/retail   issuer is untrusted or the certificate has been revoked. Your NGFW must allow you to  Install Avg With License Number activation accept or deny traffic that  avg internet security meets any combination of these criteria.
6. Enforce cipher suites: Cipher suites include key exchange algorithms, such as RSA, DHE and ECDHE; encryption algorithms Install Avg With License Number activation, such as 3DES, RC4 and variants of AES; and authentication algorithms, such as MD5 and SHA variants. The NGFW must support multiple cipher suites and allow you to enforce those that meet your security requirements. You should be able to choose whether to allow or block traffic that does not meet your specified cipher suites.
7. Enforce protocol version: You may need to enforce the use of specific SSL/TLS versions, such as TLS 1.2. The NGFW must offer avg.com/retail   flexibility in enforcing specified protocol versions and blocking traffic that uses any weaker version.
8. Integrate with hardware security modules: An HSM is a physical device that manages digital keys, including secure storage w.avg.com/activate and generation. It provides both logical and physical protection of these materials against avg.com/activation unauthorized use and potential adversaries. Your NGFW must Install Avg With License Number activation integrate with an HSM for storing private keys and master keys. Even if your organization does not currently require keys to be stored in an HSM, you may need this functionality in the future.
   
9. Allow users to opt out of SSL decryption: In some cases, you might need to alert users that the NGFW is decrypting certain web traffic avg.com/activation and allow avg.com/retail   them to terminate sessions #ww.avg.com/activate they do not want inspected. Your NGFW must allow SSL opt-out so avg internet security users are notified that their session is about to be decrypted and can choose to proceed or terminate the session.