However, SSL inspection itself is violating GDPR as it effectively stores (mainly employees') private passwords.
Is ssl inspection really needed to mitigate loss of data and a valid tool to comply with gdpr?
The reasoning for this is mostly:
Malware can use TLS to load malicious payloads and exfiltrate data + Data loss and data breaches are targeted by GDPR => Decrypting the traffic let's you detect the malicious activity and prevent the infection / notice the exfiltration, which can help you staying GDPR compliant.
IANAL, but as long as it's a black box and the traffic doesn't get stored nor is accessible, the logs don't contain any personal information and the users are in the know about this processing, it should be okay.
SSL Inspection is Imperative Under GDPR https://www.a10networks.com/blog/ssl-inspection-imperative-u...
Here is an update for discussion Spooky23!
GDPR Controversial Topics https://www.eugdpr.org/controversial-topics.html
There was a post asking about SSL necessity for GDPR and I didn't research the question properly.
If a website isn't payment orientated or doesn't hold sensitive information (Ex. email, credit cards, addresses, forum etc.) Why would you need to invest in SSL? Another?
How is the site coded? Ex. XHTML/HTML/CSS || Or CMS, PHP, JavaScript
Any feedback would greatly be appreciated!