3 ms·

You were one of the reasons I wanted to block outbound non-web traffic from clients at the perimeter when I was a CISO. Unfortunate for me, but I guess fortunat

You were one of the reasons I wanted to block outbound non-web traffic from clients at the perimeter when I was a CISO. Unfortunate for me, but I guess fortunate for the developers, who wanted to SSH home, I got vetoed.

lxgr 4y ago
Networks with outbound SSH access blocked are depressing. It‘s not that hard (but still annoying) to tunnel through them via HTTPS or similar.
- AviationAtom 4y ago
  I do understand the pain when it's a public one, but in corporate land it really does make big difference for security. If you have the funds the Deep Packet Inspection is a big way to defeat attempts to tunnel through HTTPS, DNS, or the like.
  - zamadatix 4y ago
    Only if you SSL inspect which is a god awful maintenance/support burden even if you already have full control of every system which accesses the web from your network (pretty much excluding any usable guest access otherwise that becomes the next hole). There are definitely places that level of security make sense to maintain but typically as a requirement not something someone wants to do. Even then you haven’t really solved that particular issue as it’s a people problem not a tech problem. It’s like trying to stop an employee from robbing the bank by getting a thicker vault door in that it’s just not the right type of incentive/disincentive to make an impact.
    - MayeulC 4y ago
      There are also countless ways to evade this: iodide (tunnel over dns), encapsulating encryped traffic in non-encrypted http, etc. DPI just makes it harder, so does terminating ssl earlier, or blocking outbound ports.
  - lxgr 4y ago
    > in corporate land it really does make big difference for security. When measuring security by "number of boxes checked", yes. Unfortunately, these boxes are often overly generic, years too old, or both. > If you have the funds the Deep Packet Inspection is a big way to defeat attempts to tunnel through HTTPS, DNS, or the like. What's there to inspect (unless you are decrypting all TLS in a middlebox with a root CA trusted by all clients)? How would you distinguish a "normal" WebSocket connection (as used by many sites these days) from a tunneled SSH connection, for example? If you generally want to allow your users to reach the broader public internet (or even just web), this approach seems completely futile.

lxgr 4y ago

Networks with outbound SSH access blocked are depressing. It‘s not that hard (but still annoying) to tunnel through them via HTTPS or similar.

AviationAtom 4y ago
I do understand the pain when it's a public one, but in corporate land it really does make big difference for security. If you have the funds the Deep Packet Inspection is a big way to defeat attempts to tunnel through HTTPS, DNS, or the like.
- zamadatix 4y ago
  Only if you SSL inspect which is a god awful maintenance/support burden even if you already have full control of every system which accesses the web from your network (pretty much excluding any usable guest access otherwise that becomes the next hole). There are definitely places that level of security make sense to maintain but typically as a requirement not something someone wants to do. Even then you haven’t really solved that particular issue as it’s a people problem not a tech problem. It’s like trying to stop an employee from robbing the bank by getting a thicker vault door in that it’s just not the right type of incentive/disincentive to make an impact.
  - MayeulC 4y ago
    There are also countless ways to evade this: iodide (tunnel over dns), encapsulating encryped traffic in non-encrypted http, etc. DPI just makes it harder, so does terminating ssl earlier, or blocking outbound ports.
- lxgr 4y ago
  > in corporate land it really does make big difference for security. When measuring security by "number of boxes checked", yes. Unfortunately, these boxes are often overly generic, years too old, or both. > If you have the funds the Deep Packet Inspection is a big way to defeat attempts to tunnel through HTTPS, DNS, or the like. What's there to inspect (unless you are decrypting all TLS in a middlebox with a root CA trusted by all clients)? How would you distinguish a "normal" WebSocket connection (as used by many sites these days) from a tunneled SSH connection, for example? If you generally want to allow your users to reach the broader public internet (or even just web), this approach seems completely futile.