Puppet uses client RSA certificates and SSL/TLS. That is industry standard technology that you use for things like online banking. It is built to be difficult t

Puppet uses client RSA certificates and SSL/TLS. That is industry standard technology that you use for things like online banking. It is built to be difficult to man in the middle. Client certificate auth will not work if you intercept or impersonate the master. If your security officer thinks this is insecure, he is either ignorant of what puppet is doing or is incompetent. Also, in scaling large distributed systems (what I do for $day_job) pull model is much more robust than a push. What they are telling you is pretty much the opposite of my professional experience