Branch SD-WAN decryption rollout versus pinned POS terminals

Decryption is a means to inspection, not a compliance checkbox. Scope it by what you can inspect, afford to process, and safely break.

Scoping logic:

• Decrypt where inspection yields detection value and breakage is low: unsanctioned SaaS, newly registered domains, file-sharing uploads, remote-access categories, raw IP and non-standard ports.
• Exclude where the endpoint is cryptographically pinned and unmanaged: the POS fleet. Decryption here does not fail safe - it fails the transaction, which is a revenue event, not a ticket.
• Exclude where regulation forbids it: finance and health are already out, correctly.
• Capacity is a hard constraint, not a tuning knob. 5x CPU on the small-store model means decryption there is a self-inflicted outage. Either decrypt centrally at the hub for those 60 stores (accepting backhaul latency and WAN cost) or limit them to targeted high-risk categories.

Exception governance: every exclusion needs a written justification, a named owner, an expiry date, and a compensating control. A pinned-cert POS exemption without compensation is an accepted blind spot; with segmentation and a payment-processor allowlist it is a managed risk.

Message to the sponsor: full decrypt-everything at 180 sites by quarter end is not achievable and would not improve security. Propose a phased plan - 100% of sites on targeted high-risk-category decryption within the quarter, POS permanently exempted with compensating controls, and small-store capacity remediated by hardware refresh or hub breakout in the following quarter. Present the 340 tickets and 22 broken stores as evidence that the pilot did its job: it found the boundaries before production did.

The answer is that decryption was never the PCI control - segmentation, restriction of egress, and monitoring are. The POS segment is protected by preventing it from being a general-purpose internet path.

Controls to describe:

1. Microsegmentation. POS VLAN can reach only the payment processor endpoints; no browsing, no email, no lateral path to corporate. Enforced by policy, verified by test.
2. Destination allowlisting at the application layer. Egress permitted by FQDN/IP and port to the processor only; everything else denied and logged. This makes the exemption narrow in a way decryption could not.
3. Integrity monitoring without payload inspection. The firewall still sees connection metadata: SNI (where visible), certificate subject and issuer, JA3/JA4 fingerprints, byte counts, and timing. A terminal talking to a newly observed destination or presenting an unexpected certificate generates an alert even though the payload is opaque.
4. Endpoint and terminal hardening. Terminal lockdown, no local admin, vendor-managed firmware cadence.

Evidence package:

• The documented exception with owner, rationale, expiry, and the compensating-control mapping.
• A segmentation test report: attempted connections from the POS VLAN to a set of non-payment destinations, all denied, with timestamps.
• Firewall rule and policy export showing deny-by-default egress for the segment.
• Sample alert output from the metadata-based detections, proving the monitoring is live rather than theoretical.

The audit trap to avoid is presenting "we decrypt everything else" as the compensating control. That is not a control over the POS segment - it describes the rest of the network.

Accept that payload inspection is unavailable and shift to metadata, flow behavior, and endpoint telemetry.

What remains visible:

• TLS fingerprinting (JA3/JA4). Client-side fingerprints identify malware families and rogue tooling even when the destination is unknown; server-side fingerprints catch mismatched or self-signed infrastructure.
• Certificate metadata. Issuer, validity period, subject, and self-signed status. Short-lived certificates issued by a CDN in front of a phishing kit are still anomalous relative to your baseline. Note that with ECH you may lose SNI entirely, but the certificate is still exchanged after the handshake.
• DNS. Query logging is often the highest-yield signal once payload is hidden - newly registered domains, DGA patterns, and lookups that never produce a corresponding connection.
• Flow shape. Bytes in/out ratios, connection duration, beaconing periodicity and jitter, upload-to-download asymmetry. Beacon detection on periodic small flows is a classic compensating control for undisclosed C2.
• Endpoint agents. Where the branch cannot see, the host can. For the pinned POS fleet and ECH-heavy SaaS, endpoint telemetry is the primary sensor; treat branch metadata as corroboration.

What does not work: treating "decrypt-unsupported" as a minor log category. 18% of connections being invisible is a scope statement, and each of those categories needs a named compensating control. If a category has neither decryption nor metadata detection nor endpoint coverage, it belongs on the risk register.