SSL Inspection, DNS Filtering, and Malware Defense in Healthcare SaaS
A 2,500-user healthcare SaaS provider uses FortiSASE secure internet access with deep SSL inspection for all categories. Its electronic health record vendor uses certificate pinning, and clinicians report certificate errors after FortiSASE cutover. The security team also sees malware downloads from trusted business categories, DNS TXT queries to a known command-and-control domain, and high FortiSASE PoP CPU at 400 Mbps peak. The FortiSASE CA certificate is distributed by FortiClient EMS to managed Windows devices, but 300 macOS and 150 unmanaged contractor devices do not have it. Current policy applies the same antivirus, IPS, application control, and SSL profile to all users. The vendor will not provide a private key or disable pinning.
1. How do you resolve the EHR certificate errors while keeping inspection for other traffic?
Read the worked answer
Identify the EHR vendor domains and confirm the failure is certificate pinning, not a missing FortiSASE CA. For clinician access to those domains, create a narrow SSL inspection exemption or use certificate inspection only; do not turn off deep inspection globally. Keep deep inspection for other healthcare and business categories. Distribute the FortiSASE CA to all managed endpoints through EMS to eliminate unrelated trust errors, and treat unmanaged contractor devices as a separate risk tier. Validate with a test login and FortiSASE SSL logs. Compensate for the exempted EHR traffic with DNS filtering, IPS where possible, and application control.
2. Why is malware still downloading from trusted categories?
Read the worked answer
A trusted category does not mean trusted content, and inspection may not be happening. Check FortiSASE logs for SSL exemptions, unsupported ciphers, and antivirus oversize or scan errors. Verify the antivirus and IPS profiles are actually attached to the user policy, not just defined. Apply deep inspection to business categories where downloads occur, keep file-size limits realistic, and use application control to block risky file-transfer apps. DNS filtering should block known malicious domains, but it will not catch a new host. Review the download path and test with a harmless malware sample in a lab.
3. How do you address the DNS command-and-control signal and PoP CPU pressure?
Read the worked answer
The DNS TXT queries indicate DNS filtering is either not applied to all users or the command-and-control domain is uncategorized. Apply a DNS filter profile to every policy, block botnet and command-and-control categories and the specific domain, and log DNS queries. Do not disable SSL inspection to save CPU; instead, reduce deep inspection for high-volume, low-risk streaming categories and use certificate inspection there. Confirm the 400 Mbps load is within licensed PoP capacity and check which profiles consume CPU. Keep IPS and antivirus on business traffic, and monitor FortiSASE performance logs after tuning.