My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA.

Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network configuration does, so the following question assumes that this config is used to be able to decrypt my HTTPS traffic.

What justifies this practice? What are the use cases? Is this to be able to catch viruses in the traffic? Or is this used to verify what website employees go to or what data they send to the internet (data leak prevention)?

Since I'm not aware why it's used, I feel like this practice is a breach of privacy. For example, some companies tolerate to check private mails or even to make a quick payment by e-banking if needed. But then if they use a MITM, people should be aware that the IT dpt will be able to read the data (login/password, account balance,...) which is supposed to be encrypted (TLS).

  • There are lots of reasons why a company might do this. Why your company does this is up to them. Have you asked?
    – schroeder
    Jan 23 '19 at 8:50
  • Most jurisdictions require that employers notify employees if they can inspect traffic. What jurisdiction are you in?
    – schroeder
    Jan 23 '19 at 8:51

Most of your assumptions are correct. Inspecting traffic content allows a company to look for:

  • malicious traffic (not just viruses)
  • DLP violations
  • it can also be for the employee's protection against externally malicious traffic, like phishing, abuse, extortion, etc.

They will know what sites you visit through other means.

Because they own the network, the machines, and the data, they have a "duty of care" to be able to protect it all, and part of that is monitoring. But it does impact the individuals.

Companies are usually required to notify people if they can inspect traffic so that the person can choose to not engage in personal activities on the network. Many companies set up a "public" wifi so employees can connect to that, or permit the use of personal phones so people can use the cellular networks for personal business.

It sounds like you are shocked by finding this out and this might be a discussion you need to have with your IT department, HR, and/or your DPO (if applicable). You might have been given notification but you might not have known what the notification meant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.