SANS Stay Sharp Training Live Online: Quickly sharpen your skills with 1-3 day blue team & cloud courses. Save 25% thru 11/11.


To attend this webcast, login to your SANS Account or create your Account.

This webcast has been archived. To view the webcast login into your SANS Portal Account or create an account by clicking the "Get Registered" button on the right. Once you register, you can download the presentation slides below.

8 Ways To Watch The Invisible: Analyzing Encrypted Network Traffic

  • Wednesday, November 09, 2016 at 1:00 PM EST (2016-11-09 18:00:00 UTC)
  • Johannes Ullrich

You can now attend the webcast using your mobile device!



Mozilla recently observed over 50% of web traffic to Firefox users using SSL. With efforts like Lets Encrypt offering free and easy to deploy certificates, and increased user awareness regarding mass surveillance, the trend to encrypted traffic and dark networks will only increase. But this doesnt imply that one has to throw in the towel and stop watching network traffic. Even encrypted traffic still offers significant information that can be used to help secure your network. You will learn which information can be extracted from encrypted TLS traffic, how to intercept and in some cases decrypt TLS encrypted traffic and how to balance the security advantages of encryption with the need to inspect network traffic to limit data exfoliation threats.

Speaker Bio

Johannes Ullrich

Johannes Ullrich, dean of research at the SANS Technology Institute, is currently responsible for the SANS Internet Storm Center (ISC) and the GIAC Gold program. His research interests include IPv6, network traffic analysis and secure software development. In 2004, Network World named Johannes one of the 50 most powerful people in the networking industry, and SC Magazine named him one of the top five influential IT security thinkers for 2005. Prior to working for SANS, Johannes served as a lead support engineer for a web development company and as a research physicist.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.