Enhance TLS inspection with SNI session holding in AWS Network Firewall

This article discusses a new feature called SNI session holding in AWS Network Firewall that enhances TLS inspection security and control.

• SNI session holding stops TCP/TLS establishment packets from reaching the destination server until TLS inspection rules are applied
• Prevents potential security vulnerabilities by validating Server Name Indication (SNI) before establishing a connection
• Enables more precise control over outbound traffic with minimal latency
• Can be enabled when creating a TLS inspection configuration in Network Firewall
• Only applies to Suricata rules using the TLS.SNI keyword

The feature provides an additional layer of security by ensuring that connection attempts are thoroughly validated before being permitted, reducing risks from potential malicious endpoints.