4 ms·
Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times
by pm90 5y ago
Honestly: fuck corporate security and leadership who kept pushing for spying on their workers with increasingly intrusive tools. I can’t remember how many times I argued with IT that MITMing SSL was not ok (there are some tools.. crowdstrike maybe? That do this). They made their bed, now they gotta sleep in it.
- unethical_ban 5y agoIt's always interesting to hear people think they have rights on corporate networks. It is a complex issue with entry of nuance I'm too tired to thumb type. I know there are lines that shouldn't be crossed. But it is so naive to think companies shouldn't have an eye on their data. Do you think banks shouldn't have cameras in their lobbies? Or that tellers can walk in and out of the vault with black bags and no one ask what's inside?
- morbia 5y agoI don't think the OP's point was about rights as an individual on a corporate network, more about trying to backdoor your staff's equipment and the consequences of that. To use your camera analogy, you better have a good lock on the security room holding the tapes.
- bitwize 5y agoMITMing SSL is also Zscaler's MO, and guess what my job is preparing to mandate. Organizational endpoint security seems to be much more about incident response than incident prevention. That is, it's more focused on providing a nice audit trail that can be used to find and fire/arrest the perp once a breach occurs than it is at preventing breaches from happening. It probably fills a due-diligence tickbox somewhere, allowing the company to say "if a breach occurs (the probability of which is always nonzero) then we have measures in place to find out how, where, and by whom and mitigate the damage" to shareholders and important customers.
- unixhero 5y agoIt is not an audit tickbox. It is barriers on the right side of the bowtie, and in the RECOVER dimension of NIST. Here you go: https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie.png?w=1024 https://zinatullin.files.wordpress.com/2020/12/risk-bow-tie....
- unixhero 5y agoI work in corporate security. It's a great gig! MITMing SSL is something I refuse to implement, and argue against in every forum I attend.