2.3 Describe the impact of these technologies on data visibility
📘Cisco Certified CyberOps Associate (200-201 CBROPS)
1. What Is Encryption?
Encryption is a security technology used to protect data by converting it into an unreadable format.
- Original readable data = Plaintext
- Encrypted unreadable data = Ciphertext
- A key is required to convert ciphertext back to plaintext
Only systems or users with the correct decryption key can read the data.
2. Why Encryption Is Used in IT Environments
Encryption is used to protect:
- Data in transit – data moving across a network
- Data at rest – data stored on disks, databases, or backups
- Data in use – data being processed by applications
Main goals of encryption:
- Confidentiality – prevent unauthorized access
- Data integrity – protect against tampering
- Compliance – meet security and privacy requirements
3. Common Encryption Technologies in Networks
For the CBROPS exam, you must understand where encryption is used and how it affects visibility.
Common encryption technologies:
- TLS/SSL – encrypts web, email, and application traffic
- IPsec – encrypts network-to-network or host-to-network traffic
- SSH – encrypts remote administration sessions
- Disk encryption – protects stored data
- VPN encryption – secures remote access and site-to-site connections
4. Encryption and Data Visibility – Core Concept
Key exam concept:
Encryption improves security but reduces visibility into network traffic.
When traffic is encrypted:
- Security tools cannot easily inspect packet contents
- Payload data becomes unreadable
- Only metadata remains visible
This directly impacts monitoring, logging, and threat detection.
5. What Security Teams Can See vs Cannot See
When traffic is encrypted:
Security teams CAN still see:
- Source IP address
- Destination IP address
- Source and destination ports
- Protocol type (TCP, UDP, ICMP)
- Packet size
- Timing and frequency of packets
- TLS handshake information (limited)
Security teams CANNOT see:
- Actual content of the data
- Commands sent inside encrypted sessions
- File contents
- Application-level payload details
- User credentials inside encrypted traffic
This is a major visibility limitation.
6. Impact of Encryption on Network Monitoring
Traditional monitoring tools:
- Packet analyzers
- Intrusion detection systems (IDS)
- Intrusion prevention systems (IPS)
These tools were originally designed to inspect unencrypted traffic.
With encryption:
- Deep packet inspection becomes ineffective
- Malware may hide inside encrypted sessions
- Security tools must rely on behavioral analysis
7. Encryption and Threat Detection Challenges
Encryption creates challenges such as:
- Malicious traffic can look like normal encrypted traffic
- Command-and-control traffic may be hidden
- Data exfiltration can occur inside encrypted tunnels
- Signature-based detection becomes less effective
This means:
- Attacks may go undetected
- Alerts may rely on anomalies instead of content
8. Compensating Controls for Reduced Visibility
Because encryption limits visibility, organizations use alternative security approaches.
Common compensating techniques:
1. TLS Decryption (SSL Inspection)
- Traffic is decrypted at a security device
- Inspected for threats
- Re-encrypted before forwarding
- Improves visibility but raises privacy and performance concerns
2. Endpoint Security
- Inspect data before encryption or after decryption
- Uses endpoint detection and response (EDR)
3. Network Behavior Analysis
- Detects unusual traffic patterns
- Uses flow data instead of payload data
4. Logging and Telemetry
- Collects metadata from systems and applications
- Helps identify suspicious behavior
9. Encryption and Zero Trust Security
Modern security models assume:
- All traffic may be encrypted
- No implicit trust exists
As a result:
- Security shifts closer to endpoints
- Identity and access control become critical
- Visibility is achieved through authentication, authorization, and monitoring behavior
10. Benefits of Encryption (Exam Perspective)
Despite visibility challenges, encryption provides major benefits:
- Protects sensitive information
- Prevents data interception
- Reduces risk of credential theft
- Ensures secure communications
- Helps meet regulatory requirements
For the exam:
Encryption is necessary and expected in modern networks.
11. Risks of Encryption (Exam Perspective)
You must also understand the risks:
- Reduced network visibility
- Increased difficulty in detecting threats
- Performance overhead
- Complex troubleshooting
- Potential misuse by attackers
12. Key Exam Takeaways
Remember these points for CBROPS:
- Encryption protects confidentiality but reduces visibility
- Encrypted traffic hides payload data from security tools
- Security teams rely on metadata and behavior analysis
- Encryption is common in modern networks
- Visibility loss requires compensating controls
- Cybersecurity analysts must balance security vs visibility
13. One-Line Summary for Exam Revision
Encryption secures data but limits the ability of security tools to inspect traffic content, forcing analysts to rely on metadata, behavior, and endpoint visibility.
