Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal server. Under connection i only see: "The identity of this website has been verified by " This is an internal IP and not the "The identity of this website has been verified by Google Internet Authority" As I do when not running the corporate network, or on my Ubuntu VM.

As chrome allows this proxy as CA, everything seems ok, but this also makes me worry a bit... Are they actually doing a man-in-middle where they can look into my communication ?

How can I eventually set which CA I want to use? Can I use more than one?

share|improve this question
1  
Is your Ubuntu VM on a machine that's on the corporate network? If so, it sounds like they're not enforcing the use of the BlueCoat proxy. –  Ladadadada Apr 8 '13 at 18:49
1  
Just a note to help you out - in future, rather than cross posting you can hit the "flag" link underneath, select "needs moderator attention" and ask for the question to be moved. A nice moderator will then shift it for you :) All existing answers etc will move with the question. –  user2213 Apr 8 '13 at 18:50
    
@AntonyVennard thanks. Still new to this platform, sry to to comply... –  dylf Apr 8 '13 at 19:46
    
@dylf no problem, that's why I pointed it out :) You'll soon pick up the norms etc. Welcome to Security SE! –  user2213 Apr 8 '13 at 19:49
    
@Ladadadada Yes, it seems like it is not enforced. Which is kinda strange... –  dylf Apr 9 '13 at 5:51
add comment

3 Answers

up vote 6 down vote accepted

As other answers have already covered, Blue coat (amonngst other security products) have the capability to intercept SSL sessions for users on the network, to inspect the traffic.

What your company can and cannot do with this information depends on local laws and potentially the contract you signed when you joined the company.

If you have sufficient privileges on your local machine you may be able to remove the bluecoat CA from your trusted CA list, however all that would do would be to produce warnings in your browser as the sites you visit would then appear to have untrusted certificates (i.e. the traffic interception would still happen).

If you're concerned about what your company are doing with the information then you could try speaking to a security or privacy officer (or potentially HR) to see what the company policy is on the matter, but ultimately the only way to avoid the interception would be to use a device/connection that's under your control.

share|improve this answer
add comment

You are using your work machine. Your employer has every right to perform a MITM on you. There are legitimate reasons for doing so.

If you want to avoid this, use your own machine for personal stuff and use your work machine strictly for work.

share|improve this answer
5  
Might be better to say "your employer may have a right to perform a MITM on you depending on local laws in your jurisdiction and the contract you signed when you joined the organisation" –  Rоry McCune Apr 8 '13 at 18:25
    
according to local danish law your private mails are considered as private. Also if the private mails are stored in your corporate inbox. Follow this link to a danish lawfirm that is explaning this. bit.ly/16IRKqE –  dylf Apr 8 '13 at 20:19
add comment

It's common practice to do this and they are indeed doing a kind of man in the middle. Blue Coat works as a proxy, but also inspects the websites you are looking at (refer to https://kb.bluecoat.com/index?page=content&id=FAQ463). Considering you are working on their network, they have the right to do this. Do note that Blue Coat is a tool often used to:

  • prevent users from downloading or visiting bad links
  • content filtering
  • Data Loss Prevention (for instance sending corporate documents to your private gmail)

The SSL proxy is actually used for the second and last one to my knowledge, I'm not sure about other possible uses. Do note that, depending on the country you live in, there are strict rules on how this data must be handled. But as said before, it's not your network, your employer can actually do this as it is probably contained within your contract.

share|improve this answer
2  
no, it depends on jurisdiction and contract terms, whether the employer is allowed to do it at all. Let alone without consent. in most cases consent for such stuff is folded into something else you signed. –  ewanm89 Apr 8 '13 at 18:50
1  
My employer uses bluecoat both as a content filter and for DLP. They also have an SSL whitelist that allows financial/medical/govt sites to be accessed without being snooped (caveat; I've never actually visited my banks from work so I don't have any info on how extensive the list is). –  Dan Neely Apr 8 '13 at 19:51
    
I have looked into my contract and the privacy policies issued by my employer. They state that the internet traffic is "monitored to prevent unwanted and malicious traffic". Though not mentioned anything about luring private connections to eg gmail. –  dylf Apr 8 '13 at 20:07
1  
there you have it, they are doing content filtering. –  Lucas Kauffman Apr 8 '13 at 20:08
    
The effect of such MITM filtering/snooping is usually people bringing mobile devices (BYOD) and using those instead.Security is actually weakened by this approach. –  foo May 2 '13 at 4:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.