Cryptographic security audit using network service zone locking

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed configured to:
• receive captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
• identify, from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
• determine whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface;
• and
• cause performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising:

• receiving captured traffic flow data regarding an encrypted traffic flow sent via a network between a first device assigned to a first network zone and a second device assigned to a second network zone;
• identifying, from the captured traffic flow data, one or more cryptographic parameters of the encrypted traffic flow;
• determining whether the one or more cryptographic parameters of the encrypted traffic flow satisfy an inter-zone policy associated with the first and second network zones, wherein the inter-zone policy defines which cryptographic parameters of the encrypted traffic flow are allowed between the first and second network zones and is determined based on input received via a user interface;
• and
• causing performance of a mitigation action in the network when the one or more cryptographic parameters of the encrypted traffic flow do not satisfy the inter-zone policy associated with the first and second network zones.