Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
1

I know my company is testing something called "SSL Inspection" based on Websense, which is our proxy. I can not provide more detail about this, but does this mean that in principle all my SSL traffic, for example my web bank password or security PIN, could be actually read by WebSense ?

share|improve this question
1  
I'v already answered, but felt I should clarify something - are you asking if Websense (the makers of the monitoring tools) can read all your data, or if your employers can read all your data? – Graham Hill Jun 13 '12 at 12:41
Thanks, my concern is mainly with my employers. I also think that the users should be informed about this, even if I doubt it will be done in my company. Because, as you said it's like a "man in the middle" attack. If you don't inform me, I don't see really so much difference with respect to a "true" attack. – castigli Jun 13 '12 at 21:21
1  
Ah, but it's their computer and their network: they can do what they like with it. – Graham Hill Jun 14 '12 at 9:23
3  
@GrahamHill, depending on the jurisdiction, the employee council must agree and the employees must be informed. – Hendrik Brummermann♦ Jun 15 '12 at 13:00

3 Answers

up vote 6 down vote accepted

Yes. With that configuration WebSense can decrypt and analyze data. Here is what WebSense does as a proxy with ability to inspect SSL connections.

  1. Certificate validation ensures the following

    • Certificate is not expired
    • Certificate is not revoked
    • Certificate owner and URL have the same identity
    • Certificate is issued by a trustworthy CA

  2. Network Security Administrator has the power to decide which site to be allowed not the client.

    • Any decision about the trustworthiness of a certificate must be made solely by the security administrator.
    • Any exception to the rule can only be made and allowed by the security administrator.
    • The user of a client workstation can only request exceptions, but not make them.

  3. Control over data transmitted

    • Data can be decrypted and hence inspected for malware.
share|improve this answer
I understand these needs, but I would like to have proof that all the decrypted data are not stored anywhere, nor can be obtained by the people operating the system. – castigli Jun 13 '12 at 21:29
That would be specific to your setup. The administrator might configure the device to log with debugging level that might contain html content and user data. – Kapish M Jun 13 '12 at 21:48
up vote 11 down vote

Yes, SSL Inspection is essentially a man-in-the-middle "attack" (except it's not really an attack since it's being done by the infrastructure owner) with the intention of being able to read all traffic originating from your company machine or crossing your company network, even if SSL is being used.

Consequently, you should not send anything from your company issue machine, or over your company network, that you do not want your corporate security team to read.

(Which is a good general rule in any case.)

Some other points to bear in mind:

  • A reasonable company will not care about your personal data.
  • An ethical security team will go to some lengths to avoid seeing personal data
  • A sensible company will have documented what they will and won't do - see what's been published.
  • There is a small but non-zero risk with any such system that a real attacker will compromise the monitoring system.
  • There are other methods available to a corporate security team for monitoring coputer use - they can deploy keyloggers, for example.

If an organization has to implement a robust Data Loss Prevention system, they're going to have to look at everything - so even though they are implementing SSL Inspection it doesn't mean they have evil intent. Not much fun for their employees, of course, which is why transparency is so important.

share|improve this answer
up vote 1 down vote

Some Security.SE links on this site that may help you:

share|improve this answer
Thanks, it seems I have to do a lot of homework. I was a little naive to hope SSL would protect me in any case. – castigli Jun 13 '12 at 21:31
@castigli Consider also that there are other approaches an employer can use to monitor use that do not require SSL inspection, such as deploy a keylogger. – Graham Hill Jun 14 '12 at 9:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.