ETA solutions look for patterns in the traffic, read un-encrypted metadata, flag suspicious packets, and so on --- but if the traffic isn't actually decrypted for full inspection, there's no guarantee that it's devoid of malware.
@iluom, if implementing decryption at an intermediate device --- such as a proxy --- raises privacy concerns, you could attempt to tailor it. For example, I've added an exception to our privacy policy for the inspection of data coming into our organization's network. (I confess, I work in KSA where employee privacy isn't of so much concern)
At the end of the day, preventing such attacks --- or at least reducing their impact --- calls for an approach with defense-in-depth. You should have preventive and detective measures implemented at the perimeter, the end-points, and the entire networks, with the solutions integrated with one-another.
If a perimeter device using ETA doesn't detect malware, & it gets decrypted on a user's system, an end-point security system there can quarantine the malware &isolate the system, as well as relay information to integrated systems to take actions at the network level.
With a layered approach, you have some assurance that should malware get past one layer, it still has to get through others.
We can't always depend on employee awareness here --- someone who sees his system acting strangely may just lean back and start using his smart phone rather than call Support --- so the solution should also be properly configured to alert the IT Security team.
Shannon D'Cruz,
CISM, CISSP
www.linkedin.com/in/shannondcruz
