4 ms·

One of the issues is that, due to poorly constructed legislation or private contracts, there is may be a requirement to provide "industry-standard" protection t

One of the issues is that, due to poorly constructed legislation or private contracts, there is may be a requirement to provide "industry-standard" protection to various network connections. TLS 1.3 will, in due time, be the industry standard. This needs to be reconciled with the conflicting requirement to log, record, and or block connections based on content. Perhaps TLS 1.3 is not the solution here, as it can not reconcile this conflict. Perhaps something else needs to be developed that will provide a solution that meets these two requirements.

pas 9y ago
Could you cite the exact statute that requires logging mere connections? I thought most of these compliance frameworks don't really specify how, just compile, archive and produce the data periodically (or on demand). And make the system tamper-proof (or tamper-evident), and get it audited from time to time.
- wglb 9y ago
  I am not aware of legislation, but there are many industries where there are compliance requirements that require monitoring, for example financial institutions, possibly FISMA.
semi-extrinsic 9y ago
Where I work, the company has a TLS 1.2 proxy as discussed in the article. The stated purpose is to intercept malware. It frequently fails, as the fine article states, and people then either use their personal phone and 4G to wifi, or proxy traffic over ssh to a server they have at home. I can't imagine it's anything but "something must be done, we're doing something." Furthermore, as most large companies install these, won't malware authors just start proxying C&C traffic over ssh on port 80? Or use other non-interceptable secure channels?
wolfgke 9y ago
> This needs to be reconciled with the conflicting requirement to log, record, and or block connections based on content. If there is something to reconcile, the bug is in the law and should be fixed there.

pas 9y ago

Could you cite the exact statute that requires logging mere connections? I thought most of these compliance frameworks don't really specify how, just compile, archive and produce the data periodically (or on demand). And make the system tamper-proof (or tamper-evident), and get it audited from time to time.

wglb 9y ago
I am not aware of legislation, but there are many industries where there are compliance requirements that require monitoring, for example financial institutions, possibly FISMA.

semi-extrinsic 9y ago

Where I work, the company has a TLS 1.2 proxy as discussed in the article. The stated purpose is to intercept malware. It frequently fails, as the fine article states, and people then either use their personal phone and 4G to wifi, or proxy traffic over ssh to a server they have at home. I can't imagine it's anything but "something must be done, we're doing something." Furthermore, as most large companies install these, won't malware authors just start proxying C&C traffic over ssh on port 80? Or use other non-interceptable secure channels?

wolfgke 9y ago

> This needs to be reconciled with the conflicting requirement to log, record, and or block connections based on content. If there is something to reconcile, the bug is in the law and should be fixed there.