4 ms·

Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or oth

by toufka 11y ago

Doesn't this: "they are not permitted to seek out transactional information or contents when not germane to system operations and support, or to disclose or otherwise use what they have observed." [4C2b] Conflict a bit with the product's advertised description: "The Deep Session Inspection engine sees every single packet that traverses the network, reassembles those packets into session buffers in RAM, and recursively decodes and analyzes the protocols, applications and content objects in those session buffers in real-time - while the sessions are occurring. This allows XPS to “see deeper” into applications and, in particular, the content that’s flowing over the network." [1] Boiled down: "University employees are not permitted to seek out... content when not germane to system operations and support", juxtaposed against, "XPS reassembles those packets... and content objects... to "see deeper" into applications and, in particular, the content that's flowing over the network." Or do we go all bureaucratic-NSA-legalese and say that, "all content is [could be] germane to some kind of ethereal 'persistent threat'". And that "'automated packet inspection' based on human-generated rulesets is different from a human 'seeking out' content." If so, then there shouldn't even be a privacy carve-out, as there's nothing from which to carve. And the first sentence in the policy is entirely meaningless. [1] https://www.fidelissecurity.com/sites/default/files/ds_fidelis_xps_1509.pdf https://www.fidelissecurity.com/sites/default/files/ds_fidel...

jcrawfordor 11y ago
I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.
- toufka 11y ago
  But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?

by toufka 11y ago

jcrawfordor 11y ago

I would argue that reviewing traffic is obviously germane to security monitoring, which is by definition monitoring traffic for security incidents. Edit: Content included. Content is where the bad things go, of course, and a lot of the features that come out of full packet data are the ability to do things like auto-detonation of executable files for malware detection. Extremely content-based detection heuristics.

toufka 11y ago
But would you argue that reviewing content is germane to security monitoring? Content and traffic are very different things. And is that really the (required) 'least invasive' mechanism to achieve a properly functioning network?