3 ms·

The premise is that a business needs to know what kind of data is passing through its networks. SSL forward proxy (man in the middle) helps this by letting the

The premise is that a business needs to know what kind of data is passing through its networks. SSL forward proxy (man in the middle) helps this by letting the firewall see contents of data, more thoroughly govern access to websites and subcomponents of websites, and so on. For example, with MITM enabled, a Palo firewall can grant access to the viewing of Youtube videos, but not the upload or commenting of them. It can also scan files for malware, do analysis on shady looking javascript, and run DLP and credential checks to make sure no one is accidentally sending sensitive data to the wrong site. The SSL forward proxy feature of Palos has a number of things that preserve the security of TLS connections, such as requiring a minimum TLS version, "passing through" cert errors like expiration or bad CN, and so on. I've worked with PA firewalls for a while.

dcow 3y ago
Honest question: have you ever seen a corporate TLS middleware box stop an active threat? And I don’t mean drive-by crap like port scanning for sshd…
- chelmzy 3y ago
  Its typically used for detecting malware, detecting data loss prevention, or forensics. "Drive by crap like port scanning for sshd" isn't even relevant to why companies mitm SSL. And yes I see it detect but not stop active threats on a daily basis.
  - dcow 3y ago
    These tools typically claim to block or catch stupidly high number of threats per unit time. And they usually bucket the drive-by stuff as a threat to achieve this narrative. I agree it’s hogwash. So you’re essentially admitting that these TLS boxes are more about controlling employees and “data loss prevention” than actually preventing real threats and doing honest security. Got it. https://honest.security https://honest.security
    - unethical_ban 3y ago
      >I agree it’s hogwash. I think the parent commenter was pointing out that "MITM TLS box" has nothing to do with sshd scans. Not that MITM TLS boxes have no use. Oh, and #4 on that "tenets of honest security" is an opinion not shared by all. In the modern era of guest wifi and ubiquitous personal mobile devices, personal use on a work machine is not necessary or advisable. That said, in most places it is common to *not* decrypt websites related to health and government and banking. Everything is about liability and protection of company data.
      - dcow 3y ago
        You know what I mean, the TLS middleware is part of your IDS suite. Anyway. Personal use was not the norm. Locking machines down was. VPNs, corporate network perimeters, blocking copy paste (my god), TLS middleware boxes. It all sucks. And inspecting internet traffic is a breach of human rights among adults. Then we grew out of it. Now we have identity perimeters. Strong identity and yubi keys, webauthn, SSO. Honest.security reflects how people operate today. Modern IT stacks operated by ethical teams don’t do traffic inspection. We agree, TLS inspection is about control, not security. And that’s why it’s unethical. “No personal use” also just doesn't work, ideologically. Gotta access your bank for payroll, financial stuff for 401k, RSUs. HR portal has to be accessible on the personal side too for taxes healthcare and emergencies. Been there done that move on. I will concede that there are isolated highly security sensitive situations where full device control is needed like maybe for the employees or machines with access to a CA or production deployment keys or classified information with human loss of life at stake. But the no personal use mantra is not a blanket philosophy that’s healthy or good for modern society and isn’t relevant in 99.99% of use cases. You can even look at MDMs which have shifted from full device control to hybrid support.
- GartzenDeHaes 3y ago
  These are more of an analyst tool for detection than blocking.
userbinator 3y ago
I run a MITM proxy for adblocking too, but haven't heard of any companies doing that with theirs.
mistrial9 3y ago
> a business needs to know what kind of data is passing through its networks a business... without context this appears to be a "free" card for any amount of micromanagement or intra-company snooping.. locks on the cabinets with the cheap coffee in it.. that level of petty.. sure, there are larger objectives but the way this is said, there appear to be no checks and balances.. it could be like a fish-in-a-barrel snooping free-for-all. as one reference, UC Berkeley put in "deep packet inspecting" mail servers more than 12 years ago.. to watch faculty email content.
- FuriouslyAdrift 3y ago
  Companies have a legal and fiduciary duty wrt everything that goes on with their equipment and services. Examples: I was the regional IT director at an extremely large, French owned, financial organization that had a child pornography ring operating among a couple of employees and several outside entities. The investigation and apprehension involved the FBI. At the same company: FINRA investigation into illegal insider trading at the commodities brokerage part of the company. This stuff is going on all the time. Some of it involving law enforcement, national intelligence services (I have worked with fusion centers several times, too), and internal HR/legal. You just don't know about it because you aren't in ops/secops/legal/hr/compliance.
  - mistrial9 3y ago
    "you don't know" and "all employees require no-consent supervision" and Fusion Centers .. yes, you are right, we disagree

dcow 3y ago

Honest question: have you ever seen a corporate TLS middleware box stop an active threat? And I don’t mean drive-by crap like port scanning for sshd…

chelmzy 3y ago
Its typically used for detecting malware, detecting data loss prevention, or forensics. "Drive by crap like port scanning for sshd" isn't even relevant to why companies mitm SSL. And yes I see it detect but not stop active threats on a daily basis.
- dcow 3y ago
  These tools typically claim to block or catch stupidly high number of threats per unit time. And they usually bucket the drive-by stuff as a threat to achieve this narrative. I agree it’s hogwash. So you’re essentially admitting that these TLS boxes are more about controlling employees and “data loss prevention” than actually preventing real threats and doing honest security. Got it. https://honest.security https://honest.security
  - unethical_ban 3y ago
    >I agree it’s hogwash. I think the parent commenter was pointing out that "MITM TLS box" has nothing to do with sshd scans. Not that MITM TLS boxes have no use. Oh, and #4 on that "tenets of honest security" is an opinion not shared by all. In the modern era of guest wifi and ubiquitous personal mobile devices, personal use on a work machine is not necessary or advisable. That said, in most places it is common to *not* decrypt websites related to health and government and banking. Everything is about liability and protection of company data.
    - dcow 3y ago
      You know what I mean, the TLS middleware is part of your IDS suite. Anyway. Personal use was not the norm. Locking machines down was. VPNs, corporate network perimeters, blocking copy paste (my god), TLS middleware boxes. It all sucks. And inspecting internet traffic is a breach of human rights among adults. Then we grew out of it. Now we have identity perimeters. Strong identity and yubi keys, webauthn, SSO. Honest.security reflects how people operate today. Modern IT stacks operated by ethical teams don’t do traffic inspection. We agree, TLS inspection is about control, not security. And that’s why it’s unethical. “No personal use” also just doesn't work, ideologically. Gotta access your bank for payroll, financial stuff for 401k, RSUs. HR portal has to be accessible on the personal side too for taxes healthcare and emergencies. Been there done that move on. I will concede that there are isolated highly security sensitive situations where full device control is needed like maybe for the employees or machines with access to a CA or production deployment keys or classified information with human loss of life at stake. But the no personal use mantra is not a blanket philosophy that’s healthy or good for modern society and isn’t relevant in 99.99% of use cases. You can even look at MDMs which have shifted from full device control to hybrid support.
GartzenDeHaes 3y ago
These are more of an analyst tool for detection than blocking.

userbinator 3y ago

I run a MITM proxy for adblocking too, but haven't heard of any companies doing that with theirs.

mistrial9 3y ago

> a business needs to know what kind of data is passing through its networks a business... without context this appears to be a "free" card for any amount of micromanagement or intra-company snooping.. locks on the cabinets with the cheap coffee in it.. that level of petty.. sure, there are larger objectives but the way this is said, there appear to be no checks and balances.. it could be like a fish-in-a-barrel snooping free-for-all. as one reference, UC Berkeley put in "deep packet inspecting" mail servers more than 12 years ago.. to watch faculty email content.

FuriouslyAdrift 3y ago
Companies have a legal and fiduciary duty wrt everything that goes on with their equipment and services. Examples: I was the regional IT director at an extremely large, French owned, financial organization that had a child pornography ring operating among a couple of employees and several outside entities. The investigation and apprehension involved the FBI. At the same company: FINRA investigation into illegal insider trading at the commodities brokerage part of the company. This stuff is going on all the time. Some of it involving law enforcement, national intelligence services (I have worked with fusion centers several times, too), and internal HR/legal. You just don't know about it because you aren't in ops/secops/legal/hr/compliance.
- mistrial9 3y ago
  "you don't know" and "all employees require no-consent supervision" and Fusion Centers .. yes, you are right, we disagree