On 13-Mar-07, at 2:04 PM, Robert Schwartz wrote:
There's more here then just marketroid-speak, but less here then
perfect
transparent visibility into your SSL traffic.
2 ways and 2 different market segments.
For outbound traffic inspection they MITM all connections,
terminate your
SSL connection at the border and proxy your data within another SSL
conversation (which would send a browser warning to the client,
which can
be addressed via Microsoft Active Directory GPO's to turn off all
certificate warnings).
This bit isn't necessary at all, at least not in the Bluecoat
solution. We use the Bluecoat SG in our environment (~10,000
users). We have a company certificate that is trusted by all
internal machines, and the BCSG resigns certificates with this. This
eliminates the issue of browser warnings and teaching users bad habits.
Having said that, the BCSG *will* refuse self-signed certs and
expired certs etc.
Cheers,
Tremaine Lea
Network Security Consultant
For incoming traffic, you load the SSL Key (not the certificate,
THE KEY)
of all the webservers you want to inspect on your network into the
de-SSLerizer, which can then send plain-text HTTP streams to your IDS.
Nothing can "on the fly" brute force SSL at this time. And when it
can, we
will user bigger keys. How do you tell if your web servers are being
hacked if the hacker just has to use SSL to circumvent your IPS/
IDS? With
the ones that you load your web server keys into, you can then use
an IDS
with confidence that all HTTP headers and data are being deeply
inspected.
So there's a durn fine story here for network security regarding
incoming
SSL traffic, however for outbound traffic, the cost of inspection
is that
your end-user's blindly click "accept" at every certificate warning
they
see. IMHO that tradeoff isn't justifiable under any risk assessment
framework I've found useful.
Disclaimer: These opinions are my own and no one else's. My
opinions are
neither a tacit nor an overt endorsement from my employer on any
subject .
No warranty is expressed or implied.
Hari Sekhon
<hpsekhon@googlem
ail.com> To
Sent by: focus-ids@securityfocus.com
listbounce@securi cc
tyfocus.com
Subject
Re: Bittorrent - utorrent
03/13/2007 10:20
AM
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
