Pig-in-the-Middle - TLS Decryption and Encrypted Visibility Engine Deep Dive on Cisco Secure Firewall - BRKSEC-3320#

Carol Trincia Dsouza (Cisco)

• Why: Encrypted Client Hello plus post-quantum crypto is about to break passive TLS interception — a network-security sea change this PM needs to plan for.
• What: A deep dive on the modern encryption stack as seen from the firewall: ECH, domain fronting, evasive VPNs, fake TLS, QUIC decryption, and how the Encrypted Visibility Engine fingerprints the source process of an encrypted connection without decrypting anything (from abstract only).
• How: Live demos of decryption configuration (TLS and QUIC) and of encrypted-traffic analysis, including how a free CDN account can stack QUIC + ECH + encrypted DNS + post-quantum crypto into an opaque connection, and what that means for decryption policy.
• Where applicable: Cisco Secure Firewall product context, but the threat/visibility analysis (ECH, PQ, QUIC obfuscation) is broadly relevant to any TLS-inspecting security stack.