3 ms·

This is exactly what my company went through just a few months ago when we hired an IT security guy whose first order of business was setting up a Palo Alto Net

This is exactly what my company went through just a few months ago when we hired an IT security guy whose first order of business was setting up a Palo Alto Networks firewall. Before turning on the MITM functionality he gave a presentation to everyone about what it did, and nobody (support staff, developers, administrators, management...nobody) seemed to mind except for me. This was what I sent to the HR lead immediately after the meeting: I remember a while back we all signed some document regarding data security here. I don't remember what that document said specifically -- did it mention at all the possibility that all of our network traffic could be monitored? I ask because, while [new security guy] claims that with the new firewall "No data is stored or made available for other purposes," the fact is that it absolutely can be viewed and stored, and we as the end users have no way to verify whether it is or not. On Palo Alto Network's own website there are comments from other users of our firewall asking how to disable packet inspection in the logs because, "I can also see users passwords in some cases". I understand and agree with the necessity of setting up a firewall that can inspect encrypted traffic. However, I also understand that this means everything we do or send on the office internet can be inspected by presumably anyone with access to the firewall's back end (including personal passwords and anything usually thought of as "secure"). I'm not sure how clear this is to some (or most) of the employees here. If the agreements that we signed don't reflect this, I think they should be updated and re-agreed to. [some back and forth ensued, where she reminded me of a line in the agreement that does say we can be monitored at any time] That may be fine then. All I know is that I heard some concern over being able to go to facebook and whatnot, which seemed to be relieved when we were told it would still work. I just don't know whether or not people realize that while they can still go to facebook, theoretically anything they say or do on it, including all of their login information, chats, and posts marked to be shown only to friends can (though not necessarily will) be viewed by the company as well. I could be making a bigger deal out of this than it needs to be, I just tend to take online privacy matters pretty seriously. Assurances that the data will be treated responsibly (not viewed or cached) are all well and good, but at least for me, aren't good enough. I won't be going to any personal websites on the network here at all.

philbert 10y ago
But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for incompetence to secure the MITM proxy appropriately. Acceptable use policies are not self-enforcing, they are really only used selectively, regardless if they say you shouldn't use your computer for personal use. Everybody does that to some degree and it is accepted in reality as long as it's within certain limits. If the policy was self-enforcing then half the internet would be blocked, but of course companies don't do that because no one wants to work in that environment. If you're watching porn or torrented movies, you'll either get a warning or fired, but the company will do nothing if you make an online payment. But what happens if the proxy gets hacked and the attacker gets hold of your banking/personal logins/data? Who is most likely to discover the hack? Probably the same security guys who are managing the proxy. Will the security guys do the right thing and inform management that a hack occurred? Will the company also then do the right thing and inform all their employees that a hack occurred and now you might be missing some money? Will the company choose to hide behind the “acceptable use” policy to absolve itself from liability and say that it was you doing the wrong thing and stuck with the costs of your actions? At each layer beginning at the individual working in the security team, to the whole security team, to the company management team, to everyone working at the company, that the incentives are aligned to cover up such an incident rather than reveal it. The TLS inspection proxy is a bad system and worse still it’s a dangerous system in the hands of people who are not capable of providing and unbiased assessment of the risks they are exposing themselves and everyone else to, not to mention the company. It’s more than just financial risk, it’s the moral-hazard kinds of risk that really concern me because of the lack of transparency/understanding of its roll out, the incentives to cover up when something bad happens, and the lack of legal protections afterwards.
- iamatworknow 10y ago
  I very much agree with all of these points, which is why, as I told my HR rep, I won't use any personal websites on the work network at all since the HTTPS interception was turned on. It's been a gigantic pain in the ass doing things like checking my bank statements or whatever on my phone only, but I live with it. The only non strictly work related site I go to is this one, with this throwaway account/random password. On the topic of liability and owning up to a potential hack, I think my company would be transparent about it, based on a history of being transparent about many atypical things in the past. We're not public, never received any VC funding, and nobody has any equity stake in the company except for the owner, who himself goes over the entire company's income statement in front of all the employees once per year to let us know where all the money's coming from/going to. I do believe he would do whatever he could to make it right, because the buck stops with him and him alone. Clearly that's only a small comfort if our personal information is leaked, but I don't think in my case it would be covered up. I could certainly see that being the case in most corporate structures, though.

philbert 10y ago

But it's far worse than that. Look further down in the thread where a security guy has pre-emptively invoked the "acceptable use" policy to cover for up for incompetence to secure the MITM proxy appropriately. Acceptable use policies are not self-enforcing, they are really only used selectively, regardless if they say you shouldn't use your computer for personal use. Everybody does that to some degree and it is accepted in reality as long as it's within certain limits. If the policy was self-enforcing then half the internet would be blocked, but of course companies don't do that because no one wants to work in that environment. If you're watching porn or torrented movies, you'll either get a warning or fired, but the company will do nothing if you make an online payment. But what happens if the proxy gets hacked and the attacker gets hold of your banking/personal logins/data? Who is most likely to discover the hack? Probably the same security guys who are managing the proxy. Will the security guys do the right thing and inform management that a hack occurred? Will the company also then do the right thing and inform all their employees that a hack occurred and now you might be missing some money? Will the company choose to hide behind the “acceptable use” policy to absolve itself from liability and say that it was you doing the wrong thing and stuck with the costs of your actions? At each layer beginning at the individual working in the security team, to the whole security team, to the company management team, to everyone working at the company, that the incentives are aligned to cover up such an incident rather than reveal it. The TLS inspection proxy is a bad system and worse still it’s a dangerous system in the hands of people who are not capable of providing and unbiased assessment of the risks they are exposing themselves and everyone else to, not to mention the company. It’s more than just financial risk, it’s the moral-hazard kinds of risk that really concern me because of the lack of transparency/understanding of its roll out, the incentives to cover up when something bad happens, and the lack of legal protections afterwards.

iamatworknow 10y ago
I very much agree with all of these points, which is why, as I told my HR rep, I won't use any personal websites on the work network at all since the HTTPS interception was turned on. It's been a gigantic pain in the ass doing things like checking my bank statements or whatever on my phone only, but I live with it. The only non strictly work related site I go to is this one, with this throwaway account/random password. On the topic of liability and owning up to a potential hack, I think my company would be transparent about it, based on a history of being transparent about many atypical things in the past. We're not public, never received any VC funding, and nobody has any equity stake in the company except for the owner, who himself goes over the entire company's income statement in front of all the employees once per year to let us know where all the money's coming from/going to. I do believe he would do whatever he could to make it right, because the buck stops with him and him alone. Clearly that's only a small comfort if our personal information is leaked, but I don't think in my case it would be covered up. I could certainly see that being the case in most corporate structures, though.