Are the unencrypted (decrypted) traffic stored somewhere, locally, like in a local database, and are administrators able to access meta data?

Products

• SSL Visibility Appliance Software

Issue/Introduction

Are the unencrypted (decrypted) traffic stored somewhere, locally, like in a local database, and are administrators able to access meta data?

Environment

SSLV 4.5.x.x & 5.x.x.x

Resolution

The Symantec SSL Visibility appliance is a high-performance, transparent proxy for Secure Socket Layer (SSL) network communications.

The SSL Visibility appliance is installed on a network and attached to one or more security devices. The SSL Visibility appliance decrypts SSL traffic and allows the attached security devices to view the original unencrypted data (plaintext). Decrypting SSL traffic eliminates the unknowns that are associated with the traffic, enabling your organization to combat the threats hidden within SSL. Powerful policies allow the system to bypass specific types of traffic, such as financial and healthcare data, to maintain user privacy and regulatory compliance. Please see the topology diagram below, as reference.

In the setup you described, where Symantec SSL Visibility is used to send unencrypted traffic to an Intrusion Prevention System (IPS), it's important to clarify the data handling and storage practices.

Local Database Storage: Symantec SSL Visibility typically does not store decrypted traffic in a local database by default. Its primary function is to decrypt SSL/TLS traffic for security monitoring purposes, such as threat detection and analysis. The decrypted traffic is typically passed on to security appliances like IPS for further inspection. However, organizations may configure Symantec SSL Visibility to log certain metadata or session information locally for auditing and compliance purposes. For more on this, please refer to the Tech. Doc. with the URL below.

https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/ssl-visibility/5-4/sslv_overview/UI_Overview/policies_menu/segments/segments_options.html 

Access to Meta Data: If metadata or session information is logged locally, access to this data would typically be restricted to authorized personnel, such as network administrators or security analysts, who have the necessary permissions to access and manage the Symantec SSL Visibility appliance. Access controls should be in place to ensure that only authorized users can view and analyze this data. Additionally, organizations should adhere to their internal policies and compliance regulations regarding data access and privacy.

So, while Symantec SSL Visibility primarily functions to decrypt and pass on traffic to security appliances like IPS, organizations may choose to log certain metadata or session information locally for auditing purposes. Access to this data should be restricted to authorized personnel, and proper access controls and compliance measures should be in place to protect the privacy and security of the data. It's recommended to review the specific configuration and policies implemented in your organization to ensure compliance with internal policies and regulatory requirements.