New customer - greenfield setup
-
@dashrender said in New customer - greenfield setup:
They want web filtering to keep porn/guns/violence, etc at bay.
I'd start by moving this from a hobby/emotional discussion to a business one. What "business value" are they looking for. The point here isn't to make them act like a business if they aren't one, but to use this process to define their real goal because the answer to your question is determined by that.
Right now, maybe they did a bunch of research and business thoughts and know that they need some filtering. unlikely, but plausible. But they aren't relaying enough of that information to you (suggesting that there is none) so you don't know how to solve the problem because you are lacking the information necessary to do so that had to be used to make a business decision to do so in the first place.
Also, if this WAS a business decision, how did they reach it without talking to their IT and getting the IT costs and options as part of the process? They can't, ergo we know it's an emotional response. But that's separate.
-
@dashrender said in New customer - greenfield setup:
Of course it's really only worthwhile where we can do SSL inspection (can this be down without installing certs on the clients to allow MiTM inspection?)
Nope, that's physically impossible. These types of devices I see as reckless because they are often poorly maintained, often made by questionable vendors (Sophos is fine, but many others are less respectable) and provide a single point of total egress of your data with nearly all assumed protections removed.
-
@dashrender said in New customer - greenfield setup:
With the appliance - we could also have multilayers of email scanning - i.e. MX points to Sophos - Sophos then sends to M365.
That means all email has to enter your network, be scanned, then exit your network. There's a reason no one ever suggests this. It's crazy messy and absolutely terrible design. You aren't a datacenter, using a device that has no business being an email scanner ever EVER and doing so as a hairpin to the Internet is just nuts.
-
@jaredbusch said in New customer - greenfield setup:
Can they not just discipline employees? Because this is jsut stupid talking.
No way around this. They see themselves as having a management problem and they are trying to find a scapegoat in IT.
-
@dashrender said in New customer - greenfield setup:
It's less about employees and what is accessed on their guest WiFi. They will have clients spending hours in the office, likely on the internet much of that time.
So they are acting like an ISP. They should act like an ISP and not care. I get WHY they want to care, but it's not their place to do so. Either provide them Internet access or don't. That's makes this an asinine discussion. We are talking about a huge investment in tech, that won't even work, to try to control the private behaviour of customers just to satisfy an emotional need for control? That takes this from "hard and dumb" to "impossible and absolutely stupid beyond belief."
-
@dashrender said in New customer - greenfield setup:
@jaredbusch said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
Should they go DNS filtering or NGFW with filtering subscription?
2 years ago, I would have said DNS filtering. But now browsers are starting to go around DNS with built in DNS over TLS and such.
I know several DNS providers were starting to provide DNS over TLS, and that several of the browser vendors were saying - as long as the provided DNS provider used DNS over TLS or HTTPS then the browser would respect the system's IP settings.
Have you found that to be not true? - then again, how would you know other than the traffic going to known browser based DNS over TLS IPs.
No matter what, someone that wants to work around this will. My phone, for example, would never even know that you blocked me because it always establishes a VPN first. So you'd know that I had a VPN, but that would be the end of it. All that SOPHOS magic, those certs, those IP blocks... none of it would ever show up. All that cost and me, not even trying to work around anything, would totally not be affected.
-
@dashrender said in New customer - greenfield setup:
Sadly there's more requirements for companies to keep their workspaces harassment free, etc.
No there isn't. There's no requirement or suggestion that any company can or should police visitors use of the internet. Someone lied to you. If that's a requirement, it would exist at the ISP level.
-
@dave247 said in New customer - greenfield setup:
For basic site filter, would you consider OpenDNS? Then, like Jared said, discipline the employees.
Not employees. So you can't use DNS filtering nor can you discipline. It's about controlling customers. So.... nothing will work.
-
@dashrender said in New customer - greenfield setup:
These are my thoughts as well, it's one of the draw backs to Ubiquiti gear - limited to 4 VLANs on WiFi (at least used to be).
The limit is 4 SSID. Of course that also means 4 VLAN max, since the VLAN is tied to the SSID. But the limit is not VLAN.
-
@notverypunny said in New customer - greenfield setup:
For the filtering piece, I don't know that anything relying on DNS filtering alone would be adequate in a business environment. I'd come back to your firewall option from Sophos or an equivalent FortiNet product (just because that's what I'm used to) with a web-filtering subscription. That way even if you've got devices that are getting around your DNS (especially mobile devices) to look up the undesirable sites and services, the FW would still block traffic to and from the destination based on it's web-filtering. This should be possible without any MiTM type inspection as well.
Actually I'd say the opposite. DNS is adequate in essentially all business environments because doing nothing is also adequate. DNS filtering helps to prevents accidents and that can be a good thing. But this isn't about business or employees, it's an emotionally driven attempt to control the public that are customers, but without refusing to do business with said customers.
If this was a business need, then DNS filtering is the only thing that makes sense. It assists employees trying to be good to stay good. It doesn't actually break anything that shouldn't be broken.
But in this scenario, it's useless.
-
@dashrender said in New customer - greenfield setup:
but SSL inspection on guest - nope, not interested... Hell I'd be more worried about being sue for breach of privacy.
Well you CAN'T do it without seriously breaking the law (and pulling some magic super computing stuff.) It's federally criminal to attempt without the customer voluntarily handing over their computer to you which absolutely no one will do. And it's a lot of work for someone just sitting in an office trying to watch porn.
These days, people will just use their cellular service anyway while in your office. All of your liability remains the same. It might feel like offering wifi exposes you, but if someone is going to sue you based on something downloaded or uploaded while on your premises, they will do so whether you made your network available or not.
-
@notverypunny said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
@notverypunny said in New customer - greenfield setup:
For the filtering piece, I don't know that anything relying on DNS filtering alone would be adequate in a business environment. I'd come back to your firewall option from Sophos or an equivalent FortiNet product (just because that's what I'm used to) with a web-filtering subscription. That way even if you've got devices that are getting around your DNS (especially mobile devices) to look up the undesirable sites and services, the FW would still block traffic to and from the destination based on it's web-filtering. This should be possible without any MiTM type inspection as well.
Yeah - this is where I'm leaning. I care less about the virus filtering on the guest network - where all the phones and guest devices should be.
Depending on how petty and litigious the guest network users might be, that could be a dangerous stance with regards to the guest network.
Even someone not very litigious can and should and likely would sue for this. This is a breach so egregious that no one that does so should not be in jail for a super long time. No one is actually considering doing this for guests, but if they actually did, this would be a criminal act of epic proportions.
-
@scottalanmiller said in New customer - greenfield setup:
Well you CAN'T do it without seriously breaking the law (and pulling some magic super computing stuff.) It's federally criminal to attempt without the customer voluntarily handing over their computer to you which absolutely no one will do. And it's a lot of work for someone just sitting in an office trying to watch porn.
Most common people will simply get the portal, tap anything it says and thus agree to it all. So yeah, you are wrong that no one does it.
-
@scottalanmiller said in New customer - greenfield setup:
These days, people will just use their cellular service anyway while in your office.
From the random stuff I see, I would say that is a 50/50 shot.
-
@jaredbusch said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
These days, people will just use their cellular service anyway while in your office.
From the random stuff I see, I would say that is a 50/50 shot.
If blocked, i mean
-
@scottalanmiller said in New customer - greenfield setup:
@jaredbusch said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
These days, people will just use their cellular service anyway while in your office.
From the random stuff I see, I would say that is a 50/50 shot.
If blocked, i mean
Absolutely, yes.
-
@jaredbusch said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
Well you CAN'T do it without seriously breaking the law (and pulling some magic super computing stuff.) It's federally criminal to attempt without the customer voluntarily handing over their computer to you which absolutely no one will do. And it's a lot of work for someone just sitting in an office trying to watch porn.
Most common people will simply get the portal, tap anything it says and thus agree to it all. So yeah, you are wrong that no one does it.
Is that all that it takes to get the phone or computer to install the certs and hand over man in the middle access? I've not done it, because... only a crazy person would.... but I thought it took several steps and a lot of warnings from most mobile devices.
-
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
They want web filtering to keep porn/guns/violence, etc at bay.
I'd start by moving this from a hobby/emotional discussion to a business one. What "business value" are they looking for. The point here isn't to make them act like a business if they aren't one, but to use this process to define their real goal because the answer to your question is determined by that.
Right now, maybe they did a bunch of research and business thoughts and know that they need some filtering. unlikely, but plausible. But they aren't relaying enough of that information to you (suggesting that there is none) so you don't know how to solve the problem because you are lacking the information necessary to do so that had to be used to make a business decision to do so in the first place.
Also, if this WAS a business decision, how did they reach it without talking to their IT and getting the IT costs and options as part of the process? They can't, ergo we know it's an emotional response. But that's separate.
I asked them - I know you and JB are likely glaring at me for that one - but that's where it started.
I am their IT - they are asking me what they should buy.
a few years ago it would have simply been - an EdgeRouter - some Unifi APs and call it good.
But really - I mainly started this thread to see if UTM appliances are really a better solution for most businesses today because of the threat landscape. (and maybe not UTM specifically - perhaps separate appliances when/where needed).
i.e.
web filtering to prevent access from known bad websites/IPs
SSL interception/AV scanning at the edge (in addition to the endpoint).So I guess - there hasn't been to much emotion yet - just questions.
Why do they want to filter especially on the guest network - seems kinds obvious, they don't want to support people looking at things they don't support - like porn, violence, etc.
-
@scottalanmiller said in New customer - greenfield setup:
@jaredbusch said in New customer - greenfield setup:
Can they not just discipline employees? Because this is jsut stupid talking.
No way around this. They see themselves as having a management problem and they are trying to find a scapegoat in IT.
This was never about the employees - it's really more about limiting the guests and what they can access.
-
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
@jaredbusch said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
Should they go DNS filtering or NGFW with filtering subscription?
2 years ago, I would have said DNS filtering. But now browsers are starting to go around DNS with built in DNS over TLS and such.
I know several DNS providers were starting to provide DNS over TLS, and that several of the browser vendors were saying - as long as the provided DNS provider used DNS over TLS or HTTPS then the browser would respect the system's IP settings.
Have you found that to be not true? - then again, how would you know other than the traffic going to known browser based DNS over TLS IPs.
No matter what, someone that wants to work around this will. My phone, for example, would never even know that you blocked me because it always establishes a VPN first. So you'd know that I had a VPN, but that would be the end of it. All that SOPHOS magic, those certs, those IP blocks... none of it would ever show up. All that cost and me, not even trying to work around anything, would totally not be affected.
Good point.
