4 ms·

I can't believe checking for malware signature, which can be done much more easily from the browser (and is already done, indirectly and efficiently by chrome f

by rixed 11y ago

I can't believe checking for malware signature, which can be done much more easily from the browser (and is already done, indirectly and efficiently by chrome for instance), justifies MITMing everyone at great expense. In any case, signature check is not going to be useful in any scenario of targeted attack that I can imagine. I can easily believe, though, that some BOFH is more than happy to retrieve the amount of logs he has in the good old days of plain http.

meowface 11y ago
This is how all network security appliances work. All IDS or IPS appliances do this. Running something open source like Snort or Suricata? It's "MitMing" you, too. (More accurately "Man-on-the-Side'ing" for most installations, since they're typically IDS and not IPS, but I'm just using the same alarmist term you did to make my point.) All "smart firewalls" (sometimes dubbed "nextgen firewalls" by marketing departments) do this. If your network uses firewalls from Palo Alto, that firewall is doing nearly the exact same things as this Fidelis appliance. Either most of the same features, or all of the same if you pay a little extra. All proxies do this, except only for 80/443. All host IDS agents do this as well. >(and is already done, indirectly and efficiently by chrome for instance) Chrome isn't going to detect your machine beaconing out via malware that's already installed. Chrome just has lists of bad URLs and URL paths. Chrome's security features certainly provide another useful layer of protection, but is not nearly sufficient as a malware or intrusion detection system by itself. This article is FUD, in my opinion, for singling out just this specific appliance as if it's somehow more invasive than all the other gear on a typical large network. If you want to make an article about how packet inspection is bad in general, go ahead, but I think that war has been lost. If you're using someone else's network and computers, I don't think you should have a problem with a device checking the packets your computer sends and receives to see if they match specific regex or byte patterns. It's true that a proprietary appliance is going to be a bit more blackbox with exactly how it processes traffic, compared to an open source solution, but often the signature lists themselves are accessible and configurable by the customer. Sometimes the actual signature content is visible as well. Systems like these are absolutely necessary to help prevent breaches, as long as there are competent internal employees who can make full use of them. Perhaps an open source system will be a little bit better privacy-wise, on the off chance the proprietary solution you're using is secretly doing something malicious or sending sensitive traffic elsewhere on the Internet, though if it were, the scandal would likely greatly harm or ruin the company.
- deleted 11y ago
  [deleted]
- superuser2 11y ago
  For bureaucrats in their cubicles, yes, this is normal corporate network management. You have no expectation of privacy at work; if you want that, go home. As a student, though, the university is also your home ISP. And the public WiFi at the coffee shops, libraries, etc. In this context, reading your users' email is way less okay. Don't think of UCB IT as the BigCo IT department, but as Comcast.
  - meowface 11y ago
    True. I'd be less comfortable about this just as a university student trying to use the Internet. I think it's fine for employees of UCB, though.
- fulafel 11y ago
  > This is how all network security appliances work. This does not mean "network security appliances" are a good way to address security though. They're just something that companies peddling security products have successfully marketed to privacy insensitive corporate IT departments.
  - meowface 11y ago
    Many are snake oil or overhyped, but it's generally accepted by professionals that a proper IDS or IPS appliance is helpful as an additional layer. Those alone aren't nearly sufficient; many many layers are required. But they do add value. You could make the same argument about anti-virus (IDS is really just network anti-virus), and while it's true, it's also true that it's a good idea to put AV on all your endpoints.
    - fulafel 11y ago
      They might be accepted as helpful in some situations, but many security professionals would weigh the privacy against added help and recommend against them in this context. Many, hopefully most, security professionals would also disagree with requiring AV on all endpoints. (Industry practices generally aren't a good guideline, and many IT security professionals are incompetent and/or powerless to do anything besides babysit security products that just create work and increase complexity. Witness the prevalence of large corporate "intranets" with centralised firewalls, and soft chewy insides...)

by rixed 11y ago

meowface 11y ago

This is how all network security appliances work. All IDS or IPS appliances do this. Running something open source like Snort or Suricata? It's "MitMing" you, too. (More accurately "Man-on-the-Side'ing" for most installations, since they're typically IDS and not IPS, but I'm just using the same alarmist term you did to make my point.) All "smart firewalls" (sometimes dubbed "nextgen firewalls" by marketing departments) do this. If your network uses firewalls from Palo Alto, that firewall is doing nearly the exact same things as this Fidelis appliance. Either most of the same features, or all of the same if you pay a little extra. All proxies do this, except only for 80/443. All host IDS agents do this as well. >(and is already done, indirectly and efficiently by chrome for instance) Chrome isn't going to detect your machine beaconing out via malware that's already installed. Chrome just has lists of bad URLs and URL paths. Chrome's security features certainly provide another useful layer of protection, but is not nearly sufficient as a malware or intrusion detection system by itself. This article is FUD, in my opinion, for singling out just this specific appliance as if it's somehow more invasive than all the other gear on a typical large network. If you want to make an article about how packet inspection is bad in general, go ahead, but I think that war has been lost. If you're using someone else's network and computers, I don't think you should have a problem with a device checking the packets your computer sends and receives to see if they match specific regex or byte patterns. It's true that a proprietary appliance is going to be a bit more blackbox with exactly how it processes traffic, compared to an open source solution, but often the signature lists themselves are accessible and configurable by the customer. Sometimes the actual signature content is visible as well. Systems like these are absolutely necessary to help prevent breaches, as long as there are competent internal employees who can make full use of them. Perhaps an open source system will be a little bit better privacy-wise, on the off chance the proprietary solution you're using is secretly doing something malicious or sending sensitive traffic elsewhere on the Internet, though if it were, the scandal would likely greatly harm or ruin the company.

deleted 11y ago
[deleted]
superuser2 11y ago
For bureaucrats in their cubicles, yes, this is normal corporate network management. You have no expectation of privacy at work; if you want that, go home. As a student, though, the university is also your home ISP. And the public WiFi at the coffee shops, libraries, etc. In this context, reading your users' email is way less okay. Don't think of UCB IT as the BigCo IT department, but as Comcast.
- meowface 11y ago
  True. I'd be less comfortable about this just as a university student trying to use the Internet. I think it's fine for employees of UCB, though.
fulafel 11y ago
> This is how all network security appliances work. This does not mean "network security appliances" are a good way to address security though. They're just something that companies peddling security products have successfully marketed to privacy insensitive corporate IT departments.
- meowface 11y ago
  Many are snake oil or overhyped, but it's generally accepted by professionals that a proper IDS or IPS appliance is helpful as an additional layer. Those alone aren't nearly sufficient; many many layers are required. But they do add value. You could make the same argument about anti-virus (IDS is really just network anti-virus), and while it's true, it's also true that it's a good idea to put AV on all your endpoints.
  - fulafel 11y ago
    They might be accepted as helpful in some situations, but many security professionals would weigh the privacy against added help and recommend against them in this context. Many, hopefully most, security professionals would also disagree with requiring AV on all endpoints. (Industry practices generally aren't a good guideline, and many IT security professionals are incompetent and/or powerless to do anything besides babysit security products that just create work and increase complexity. Witness the prevalence of large corporate "intranets" with centralised firewalls, and soft chewy insides...)