Enhance your threat detection reasoning. In this module, you will analyze network security architecture to understand how visibility and containment are achieved at the web perimeter.
Jackson & Co. is a mid-sized law firm dealing with highly sensitive client data. Recently, the SOC observed a spike in encrypted web traffic (HTTPS) reaching uncategorized domains. The current Next-Generation Firewall (NGFW) is struggling with SSL decryption performance at scale, leading to blind spots where users might inadvertently download malware or fall victim to phishing via encrypted channels. The IT team is deploying a dedicated perimeter solution to break, inspect, and log this traffic.
Recent telemetry observed post-implementation (Splunk SIEM View):
Jackson & Co., a mid-sized law firm, is concerned about potential web-based cyber threats targeting their employees. To enhance security, their IT team implements a solution that serves as an intermediary for all HTTP and HTTPS requests. This solution allows the SOC to inspect, filter and control web traffic, helping to detect and block malicious websites, phishing attempts, and other online threats before they reach users. Which containment method is the organization using to gain visibility and control over web traffic?
The firm deployed a Secure Web Gateway (SWG) or forward proxy. Because modern malware and phishing attacks are delivered via HTTPS, the SOC was blind to the payload. By placing an intermediary device between the user and the internet, the SOC can terminate the connection, decrypt the traffic using an internal Certificate Authority (CA), inspect the payload, and then re-establish the connection to the destination.
The keyword in the scenario is intermediary. A proxy server acts on behalf of the client. It intercepts the HTTP/HTTPS request, performs its checks (like TLS inspection and category filtering), and then forwards the request. It is the architectural component that actually makes the visibility and control possible.
In a Tier 2/3 SOC environment, Proxy logs (often ingested into Splunk or Sentinel via Zscaler, BlueCoat, or Squid) are vital for hunting Command and Control (C2) beaconing. Analysts look for specific patterns: high-frequency low-volume requests to newly registered domains, uncommon User-Agent strings, or HTTP POST requests that lack a standard referrer.
How does a proxy read encrypted HTTPS without triggering browser warnings?
https://bad-domain.com, the Proxy intercepts the request.bad-domain.com signed by its own Root CA.Ready to level up your SOC skills?
Explore more CSA simulations →