5 ms·

I still find it unfortunately shallow analysis. I'm currently fighting a battle in a company in the middle of rolling out Blue Coat ProxySG. I only became awar

I still find it unfortunately shallow analysis. I'm currently fighting a battle in a company in the middle of rolling out Blue Coat ProxySG. I only became aware of it because it began causing interruptions to our work since none of the development tools get the necessary root cert to validate the certs that the proxy is rewriting. The root cert is only installed into the Windows credentials to make browsers work and it's left up to every client to fix whatever other problems they have. One of the common arguments I've encountered from people is along the lines of "if the company trusts the security people, then I trust the security people". However this ignores the fact that the company has legally enforceable agreements in the form od employment contracts, NDAs, and what-have-you that protect the company against a breach of that trust. But what kind of protection do you have as an individual if, for what ever reason, one of the security people decides to single you out while they have unsupervised access to you social media logins, personal email and credit cards numbers and financial details (and lets face the fact that everyone does all of these things to some degree on a work computer). The answer is that you more than likely have no protection at all (likely not even in workplace law). Even if you suspected someone had inappropriately accessed your personal details, the company almost certainly has an IT policy saying that you shouldn't be using your computer for personal use. You're screwed. However these inspection boxes drastically change the situation to what it was before, because most people outside the IT department won't even know about this drastic change in capability. And likely they try hard not to think about until (if) they discover something has happened. I'm sure everyone here is aware of the abuses of NSA employees spying on their wifes, or ex-es [0]. Such is human nature. Sadly I suspect that all these arguments will do little to change the situation. It seems more likely that the companies who deploy these systems are only going to listen to arguments specifically about how it is increasing work, causing delays of deliveries and affecting project costs. [0] http://www.reuters.com/article/us-usa-surveillance-watchdog-idUSBRE98Q14G20130927 http://www.reuters.com/article/us-usa-surveillance-watchdog-...

rkeene2 10y ago
TLS MITM devices also break required components of TLS, such as TLS client certificates. If you want to have TLS sessions with mutual authentication it can't go through the MITM. A way forward might be to start requiring TLS client certificates for business products. :-) For us, we use TLS client certificate authentication to authenticate almost all our users so any TLS MITM breaks that and is unacceptable. This is really common and tens of millions of people use TLS client certificates this way everyday -- mostly with client certificates on smartcards.
iamatworknow 10y ago
This is exactly what my company went through just a few months ago when we hired an IT security guy whose first order of business was setting up a Palo Alto Networks firewall. Before turning on the MITM functionality he gave a presentation to everyone about what it did, and nobody (support staff, developers, administrators, management...nobody) seemed to mind except for me. This was what I sent to the HR lead immediately after the meeting: I remember a while back we all signed some document regarding data security here. I don't remember what that document said specifically -- did it mention at all the possibility that all of our network traffic could be monitored? I ask because, while [new security guy] claims that with the new firewall "No data is stored or made available for other purposes," the fact is that it absolutely can be viewed and stored, and we as the end users have no way to verify whether it is or not. On Palo Alto Network's own website there are comments from other users of our firewall asking how to disable packet inspection in the logs because, "I can also see users passwords in some cases". I understand and agree with the necessity of setting up a firewall that can inspect encrypted traffic. However, I also understand that this means everything we do or send on the office internet can be inspected by presumably anyone with access to the firewall's back end (including personal passwords and anything usually thought of as "secure"). I'm not sure how clear this is to some (or most) of the employees here. If the agreements that we signed don't reflect this, I think they should be updated and re-agreed to. [some back and forth ensued, where she reminded me of a line in the agreement that does say we can be monitored at any time] That may be fine then. All I know is that I heard some concern over being able to go to facebook and whatnot, which seemed to be relieved when we were told it would still work. I just don't know whether or not people realize that while they can still go to facebook, theoretically anything they say or do on it, including all of their login information, chats, and posts marked to be shown only to friends can (though not necessarily will) be viewed by the company as well. I could be making a bigger deal out of this than it needs to be, I just tend to take online privacy matters pretty seriously. Assurances that the data will be treated responsibly (not viewed or cached) are all well and good, but at least for me, aren't good enough. I won't be going to any personal websites on the network here at all.
- philbert 10y ago
  But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for incompetence to secure the MITM proxy appropriately. Acceptable use policies are not self-enforcing, they are really only used selectively, regardless if they say you shouldn't use your computer for personal use. Everybody does that to some degree and it is accepted in reality as long as it's within certain limits. If the policy was self-enforcing then half the internet would be blocked, but of course companies don't do that because no one wants to work in that environment. If you're watching porn or torrented movies, you'll either get a warning or fired, but the company will do nothing if you make an online payment. But what happens if the proxy gets hacked and the attacker gets hold of your banking/personal logins/data? Who is most likely to discover the hack? Probably the same security guys who are managing the proxy. Will the security guys do the right thing and inform management that a hack occurred? Will the company also then do the right thing and inform all their employees that a hack occurred and now you might be missing some money? Will the company choose to hide behind the “acceptable use” policy to absolve itself from liability and say that it was you doing the wrong thing and stuck with the costs of your actions? At each layer beginning at the individual working in the security team, to the whole security team, to the company management team, to everyone working at the company, that the incentives are aligned to cover up such an incident rather than reveal it. The TLS inspection proxy is a bad system and worse still it’s a dangerous system in the hands of people who are not capable of providing and unbiased assessment of the risks they are exposing themselves and everyone else to, not to mention the company. It’s more than just financial risk, it’s the moral-hazard kinds of risk that really concern me because of the lack of transparency/understanding of its roll out, the incentives to cover up when something bad happens, and the lack of legal protections afterwards.
tbyehl 10y ago
> The answer is that you more than likely have no protection at > all (likely not even in workplace law). Even if you suspected > someone had inappropriately accessed your personal details, > the company almost certainly has an IT policy saying that you > shouldn't be using your computer for personal use. The answer is to stop ignoring the policy. Reserve the corporate device for work activities. Use personal devices for personal things and consider the corporate network to be hostile -- use a VPN.

rkeene2 10y ago

TLS MITM devices also break required components of TLS, such as TLS client certificates. If you want to have TLS sessions with mutual authentication it can't go through the MITM. A way forward might be to start requiring TLS client certificates for business products. :-) For us, we use TLS client certificate authentication to authenticate almost all our users so any TLS MITM breaks that and is unacceptable. This is really common and tens of millions of people use TLS client certificates this way everyday -- mostly with client certificates on smartcards.

iamatworknow 10y ago

This is exactly what my company went through just a few months ago when we hired an IT security guy whose first order of business was setting up a Palo Alto Networks firewall. Before turning on the MITM functionality he gave a presentation to everyone about what it did, and nobody (support staff, developers, administrators, management...nobody) seemed to mind except for me. This was what I sent to the HR lead immediately after the meeting: I remember a while back we all signed some document regarding data security here. I don't remember what that document said specifically -- did it mention at all the possibility that all of our network traffic could be monitored? I ask because, while [new security guy] claims that with the new firewall "No data is stored or made available for other purposes," the fact is that it absolutely can be viewed and stored, and we as the end users have no way to verify whether it is or not. On Palo Alto Network's own website there are comments from other users of our firewall asking how to disable packet inspection in the logs because, "I can also see users passwords in some cases". I understand and agree with the necessity of setting up a firewall that can inspect encrypted traffic. However, I also understand that this means everything we do or send on the office internet can be inspected by presumably anyone with access to the firewall's back end (including personal passwords and anything usually thought of as "secure"). I'm not sure how clear this is to some (or most) of the employees here. If the agreements that we signed don't reflect this, I think they should be updated and re-agreed to. [some back and forth ensued, where she reminded me of a line in the agreement that does say we can be monitored at any time] That may be fine then. All I know is that I heard some concern over being able to go to facebook and whatnot, which seemed to be relieved when we were told it would still work. I just don't know whether or not people realize that while they can still go to facebook, theoretically anything they say or do on it, including all of their login information, chats, and posts marked to be shown only to friends can (though not necessarily will) be viewed by the company as well. I could be making a bigger deal out of this than it needs to be, I just tend to take online privacy matters pretty seriously. Assurances that the data will be treated responsibly (not viewed or cached) are all well and good, but at least for me, aren't good enough. I won't be going to any personal websites on the network here at all.

philbert 10y ago
But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for incompetence to secure the MITM proxy appropriately. Acceptable use policies are not self-enforcing, they are really only used selectively, regardless if they say you shouldn't use your computer for personal use. Everybody does that to some degree and it is accepted in reality as long as it's within certain limits. If the policy was self-enforcing then half the internet would be blocked, but of course companies don't do that because no one wants to work in that environment. If you're watching porn or torrented movies, you'll either get a warning or fired, but the company will do nothing if you make an online payment. But what happens if the proxy gets hacked and the attacker gets hold of your banking/personal logins/data? Who is most likely to discover the hack? Probably the same security guys who are managing the proxy. Will the security guys do the right thing and inform management that a hack occurred? Will the company also then do the right thing and inform all their employees that a hack occurred and now you might be missing some money? Will the company choose to hide behind the “acceptable use” policy to absolve itself from liability and say that it was you doing the wrong thing and stuck with the costs of your actions? At each layer beginning at the individual working in the security team, to the whole security team, to the company management team, to everyone working at the company, that the incentives are aligned to cover up such an incident rather than reveal it. The TLS inspection proxy is a bad system and worse still it’s a dangerous system in the hands of people who are not capable of providing and unbiased assessment of the risks they are exposing themselves and everyone else to, not to mention the company. It’s more than just financial risk, it’s the moral-hazard kinds of risk that really concern me because of the lack of transparency/understanding of its roll out, the incentives to cover up when something bad happens, and the lack of legal protections afterwards.

tbyehl 10y ago

> The answer is that you more than likely have no protection at > all (likely not even in workplace law). Even if you suspected > someone had inappropriately accessed your personal details, > the company almost certainly has an IT policy saying that you > shouldn't be using your computer for personal use. The answer is to stop ignoring the policy. Reserve the corporate device for work activities. Use personal devices for personal things and consider the corporate network to be hostile -- use a VPN.