I am a student and relative noob in IT security performing research for three reasons: school, my employer and personal curiosity, and I hoped maybe someone could answer a question for me.
In a video posted to YouTube by Akamai (https://www.youtube.com/watch?v=eW_A7tUuop4), the features and present direction of the proposed changes to the TLS protocol were discussed. While I am very much for the added security benefits that TLS 1.3 will add, I am also concerned as an interested party in critical infrastructure. There were three camps mentioned as being represented in the implementation considerations of TLS 1.3 but the organisations who run critical infrastructure did not seem to be amongst them (except to say that the crypto warriors wish to obfuscate information from them). How or what is proposed for those of us who NEED to be monitoring network traffic in order to ensure our good intended employees aren't inadvertently bringing bad traffic into our networks, to continue to do our jobs effectively? As I understand it, our employee would still be able to travel to (lets say) Facebook and click away but the difference would be the inability for the network monitors to see if that link was from a malicious host... is this accurate (very simplistically to one degree or another)? Do you have any information or recommendations on how to handle this situation? There are some that I can think of but there are questions as to their ethical and legal ramifications... but this is all assuming I am interpreting the situation correctly.
To the best of my knowledge and extensive research on the web, I have been unable to locate discussions related to this topic. I found mention of it on one site where it read:
There are security tradeoffs with encrypted communications, given that many of today's security tools can't perform their tasks if the network flows are encrypted. How do you reconcile that? (http://www.darkreading.com/perimeter/qanda-internet-encryption-as-the-new-normal/d/d-id/1317783)
Which was promptly blown off as an "We recognize that and will address it later" answer (and hasn't that been the problem with IT security to date? ... I digress). It could quite possibly be that I am not using the right search terms but so far the discussion has far been one of semantics (i.e. the price of encrypting SNI, version intolerance effects, Requiring OCSP for EV, etc.) as opposed to practical application from the security admin POV.