3 ms·
While there's the potential of spying, there's also the much more common use-case of AV scanning the whole stream but otherwise not looking at it and not archiv
by pilif 10y ago
While there's the potential of spying, there's also the much more common use-case of AV scanning the whole stream but otherwise not looking at it and not archiving it anywhere.
Now we can all debate the value of AV scanning in general (I'm on the probably-not-worth-it-and-way-too-risky side), but if we attribute any kind of value to AV scanning (it might help with wide-spread attacks at the cost of facilitating targeted attacks), then being able to peek into SSL tunnels is a requirement for it to provide any kind of its proposed value.
Depending on your users level of knowledge and your updating procedure, not running AV might indeed be considered irresponsible.
If your systems are somewhat unpatched and your users oblivious to threats, then you're much more likely to be owned by and wide-spread malvertising and email spam attack (both of which AV actually protect against) than you're likely to be the victim of a targeted attack (which AV actually makes easier to pull off) just by virtue of the former being much more common than the latter.
- jcrawfordor 10y agoIn real corporate environments (where, keep in mind, most users are very non-sophisticated), this kind of inline scanning is extremely valuable. TLS intercepted data is also invaluable for post-incident investigation, for example, to determine whether or not a host A/V detection is likely valid without having to go through a costly and disruptive host forensics process (typically by grabbing the file out of retained data, or just by determining where the file actually came from). In fact, without TLS interception, post-incident investigation based on network artifacts is becoming more and more impractical as malicious actors are taking advantage of LetsEncrypt and CloudFlare to HTTPS protect their delivery and C2.