A financial company implements end-to-end encryption via SSL in the DMZ, and only IPSec in transport mode with AH enabled and ESP disabled throughout the internal network. The company has hired a…

Upgrading SSL to TLS addresses a known protocol weakness in the DMZ. Because the DMZ traffic is encrypted end-to-end, a NIPS cannot inspect packet payloads, so HIPS - which operates at the host level before or after encryption - is the appropriate IPS choice there. The internal network uses IPSec transport mode with AH only and no ESP, meaning the payload is unencrypted and fully visible to a NIPS.

Placing NIPS in the DMZ is ineffective because SSL/TLS encryption prevents the NIPS from inspecting payloads, and switching IPSec to tunnel mode does not address the core IPS placement problem.

Disabling AH removes authentication and integrity protection from the internal network, and enabling ESP would encrypt internal traffic, making NIPS unable to inspect payloads on either segment.

Enabling ESP on the internal network would encrypt the payload and prevent NIPS from inspecting internal traffic, while NIPS in the DMZ still cannot inspect TLS-encrypted payloads.