New customer - greenfield setup
-
If this was a medical office, as an example, imagine if a client claimed that security had been compromised. Any investigation would quickly turn up that the end to end encryption rules were violated and that the office had intentionally removed encryption and exposed the data and had an opportunity for people, anyone with access to the firewall, to extricate it outside of the known controls.
While unlikely to be the actual source of a breach, in court it would really only need to be shown that the data was voluntarily exposed and that would be enough for damage to be done. But if you did want to steal HIPAA data, this is exactly the kind of exposure point you'd hope for. Especially as a great many firewalls that offer this have backdoors or weak security that would normally border on being useless when used properly, but when configured as a trusted man in the middle means you have a way to siphon out the data without detection after the network monitoring controls are already past. Nothing on the network would be able to detect large volumes of data flowing out as it was flow out from the outside interface of the LAN only.
-
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
Of course it's really only worthwhile where we can do SSL inspection (can this be down without installing certs on the clients to allow MiTM inspection?)
Nope, that's physically impossible. These types of devices I see as reckless because they are often poorly maintained, often made by questionable vendors (Sophos is fine, but many others are less respectable) and provide a single point of total egress of your data with nearly all assumed protections removed.
Hey Scott, can you elaborate a bit more on that - I'm talking about the recklessness of SSL inspection. I ask because my company has a Sonicwall NSA appliance and in the past I have attempted using the "DPI-SSL" feature (deep packet inspection) which required installing the Sonicwall cert on all systems and then the traffic would be intercepted and inspected. Despite me following their guide and applying the correct settings and site exceptions, I still had some issues and ended up scrapping the effort for now. I already know your opinion on Sonicwall but I just wanted to get more insight into the whole deep packet inspection effort.
There was a big study a couple of years ago:
https://www.thesslstore.com/blog/https-interception-harming-security/Basically it's what Scott said.
-
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
Of course it's really only worthwhile where we can do SSL inspection (can this be down without installing certs on the clients to allow MiTM inspection?)
Nope, that's physically impossible. These types of devices I see as reckless because they are often poorly maintained, often made by questionable vendors (Sophos is fine, but many others are less respectable) and provide a single point of total egress of your data with nearly all assumed protections removed.
Hey Scott, can you elaborate a bit more on that - I'm talking about the recklessness of SSL inspection. I ask because my company has a Sonicwall NSA appliance and in the past I have attempted using the "DPI-SSL" feature (deep packet inspection) which required installing the Sonicwall cert on all systems and then the traffic would be intercepted and inspected. Despite me following their guide and applying the correct settings and site exceptions, I still had some issues and ended up scrapping the effort for now. I already know your opinion on Sonicwall but I just wanted to get more insight into the whole deep packet inspection effort.
So my issue with that is that it "breaks" the entire security chain. The idea behind the certificate system is that your traffic is encrypted end to end. By adding a man in the middle there is a time when the traffic is not encrypted, but both the browser and the server believe that it is.
If everything works as expected, this is fine because we trust the man in the middle, in this case. But that's asking a lot of "another system" to be completely trusted.
In reality neither of the end points truly trust the man in the middle. The "firewall" isn't a friend here, it's in the path because it already distrusts both end points. So trust is not really appropriately at play here.
On a technology side, this adds an extremely high profile target that is rarely secured close to as well as the server or the workstations are. Traditionally firewalls were an extra layer of security, rather than an extra layer of risk. A compromised firewall meant that you lost a layer of defense, not that the firewall represented a bypass to existing security measures as well. So this ends up being a lot like a VPN, everyone says it's for security, but as used it is nearly always a huge risk because risk is extended rather than the tool being used to lock it down more.
So both hard technical by adding a huge point of exposure and for bypassing existing controls; and soft technical by putting the most critical point of exposure where network admins tend to understand it the least and where politics tend to keep it from getting properly maintained.
Then comes liability. Legally you can use this in most circumstances. But only most. I would never use this without my legal team signing off on it. Because you are hijacking encrypted data mid-stream that is meant to be trusted you risk both political fallout (customers, vendors, etc. being angry or going public that data may have been hijacked - possibly without consent) and legal fallout (if this is discovered and HIPAA data was in flight, for example, it technically violated any end to end encryption laws or requirements.) Knowing decrypting network traffic midway carries a lot of risk and you really need to understand the legal or business risk to all of the traffic. It's not something you can just do and not worry about.
As a business owner, never ever would I take that risk. Huge risk, no real value to doing so. I'd have to be a seriously emotionally driven control freak to consider doing something like this.
Which brings the final problem with it... a tool like this would not be made by or deployed by those who value security. So if you have a vendor making these tools, or you have management demanding these tools, you have people who are prioritizing control or the emotional perception of control above business interests and security. Sure, a vendor like SonicWall is just catering to their client base. To them it is a good business decision, but that decision is to allow their customers to undermine their own security. So from a security perspective, this goes against all common sense and otherwise stated practices.
As an aside, IF something like this was ever warranted, it should never be put on the firewall but run in a VM like any other production workload. That people put it on the firewall instead shows how little security thinking is involved when these products are discussed. There are better ways to do this if someone actually intended to do it in a good way.
Nice! I'm glad to hear you point all those things out because I've also thought similarly about deep packet inspection / MITM functionality on the firewall. It's basically breaking that secure chain of trust, like you said, and when I first learned about it, I just though it seemed a little risky or wrong or something.
And as I added more and more exceptions, I began to think, what is the point of this if I'm going to add a bunch of exceptions? Then I would just be leaving all the untrusted sites but that sort of thing should be more filtered out using web content filtering, not DPI.
Also, I'm not defending it, but when I was attempting to enable DPI-SSL on our Sonicwall, I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
-
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
-
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
Yes, great points there. Oh hey, I was also going to ask you why you excluded Sophos from your deep packet inspection comment. I assume you will say they do it right, and if that's they case, how do they do it better / correctly?
-
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
Yes, great points there. Oh hey, I was also going to ask you why you excluded Sophos from your deep packet inspection comment. I assume you will say they do it right, and if that's they case, how do they do it better / correctly?
I only excluded them as not being an exhaustive list. I like them better than most vendors, but in a category of vendors I don't like much. They are like... if I was forced to do this, I'd choose them first most of the time. That doesn't mean I like it, I just dislike them less. Mostly experience, but also they offer most of their products in both crappy "on firewall" designs and "offloaded to a server" designs which is, at least, one step improved.
-
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
Yes, great points there. Oh hey, I was also going to ask you why you excluded Sophos from your deep packet inspection comment. I assume you will say they do it right, and if that's they case, how do they do it better / correctly?
I only excluded them as not being an exhaustive list. I like them better than most vendors, but in a category of vendors I don't like much. They are like... if I was forced to do this, I'd choose them first most of the time. That doesn't mean I like it, I just dislike them less. Mostly experience, but also they offer most of their products in both crappy "on firewall" designs and "offloaded to a server" designs which is, at least, one step improved.
Well - according to the above article - trusting them for SSL interception is just plain bad - just like most of the rest on that list.
-
@dashrender said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
Yes, great points there. Oh hey, I was also going to ask you why you excluded Sophos from your deep packet inspection comment. I assume you will say they do it right, and if that's they case, how do they do it better / correctly?
I only excluded them as not being an exhaustive list. I like them better than most vendors, but in a category of vendors I don't like much. They are like... if I was forced to do this, I'd choose them first most of the time. That doesn't mean I like it, I just dislike them less. Mostly experience, but also they offer most of their products in both crappy "on firewall" designs and "offloaded to a server" designs which is, at least, one step improved.
Well - according to the above article - trusting them for SSL interception is just plain bad - just like most of the rest on that list.
Trusting anyone with doing that, to me, is a bad idea. It's both an unnecessary point of really risky trust, and it means trusting a vendor who is supposed to be a security vendor that's willing to look the other way on security concerns. Um... it's like trusting a security guard to not need a door, who literally just told you he'll happily not worry about security because it's not his problem.
-
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
@scottalanmiller said in New customer - greenfield setup:
@dave247 said in New customer - greenfield setup:
I was able to add many category-based exceptions which included banking and medical services, among others. So at least that concern is somewhat removed there, but still.
That's good that they try. A problem with that, though, is that categories have to be maintained and trusted. So if you use Bank of America or Wells Fargo, I'm sure you are fine. But what if you use a local savings and loan or credit union or a foreign bank or do your banking through a third party site? Sure, your bank might make their list, but it might not. They make an effort, and probably a good one, but at some point it's just people making a list of sites they feel should be in a category. They don't really know. Anyone can make a fake bank website to get around that, there's no way to have enough staff to check sites. And I'm sure tons of real financial institutions get missed because no one though of checking that name.
Yes, great points there. Oh hey, I was also going to ask you why you excluded Sophos from your deep packet inspection comment. I assume you will say they do it right, and if that's they case, how do they do it better / correctly?
I only excluded them as not being an exhaustive list. I like them better than most vendors, but in a category of vendors I don't like much. They are like... if I was forced to do this, I'd choose them first most of the time. That doesn't mean I like it, I just dislike them less. Mostly experience, but also they offer most of their products in both crappy "on firewall" designs and "offloaded to a server" designs which is, at least, one step improved.
Well - according to the above article - trusting them for SSL interception is just plain bad - just like most of the rest on that list.
Trusting anyone with doing that, to me, is a bad idea. It's both an unnecessary point of really risky trust, and it means trusting a vendor who is supposed to be a security vendor that's willing to look the other way on security concerns. Um... it's like trusting a security guard to not need a door, who literally just told you he'll happily not worry about security because it's not his problem.
OK I get all that - and am more aware of things than I was before this thread.
What is your defense in layer strategy for malware, etc?
I can't recall if you're a fan of web filtering or not?
You've spoken of PiHole before, though again, not sure if you're really a fan of that - or not?
What about blacklisting at the firewall level - We've discussed Ad nauseam about how poor geo blocking is (it's just so wrong, and can frequently get in the way).
Do you rely solely on the AV of the endpoint for protection of bad shit happening to endpoints? -
@dashrender said in New customer - greenfield setup:
Do you rely solely on the AV of the endpoint for protection of bad shit happening to endpoints?
Honestly, I feel that that's a last ditch effort. Should you always have it? Yeah, on Windows. But if you need it, something is wrong. Why are people downloading malware? How are you getting malware in the first place? Typically malware is an HR problem. That doesn't mean that we shouldn't do what we can, but if we do something it needs to be real.
The problem is two fold: what you do, and what you don't do.
Anything you DO do, needs to actually be beneficial. That means actually improving your security. Anything that doesn't improve your security and/or actively makes it worse is a serious problem.
What many of these things do is... nothing. They take time, probably money, and have no security benefit. They are smoke and mirrors sold to management who hear fancy words, see fancy mock ups, and say "spend spend spend" because it makes them feel like they did something. But as IT people, we should know that much of the time, it's just BS to keep the managers on top feeling like they contribute.
Things like PiHole or CloudFlare filtering or whatever that keep you from accidentally going to a malicious website go a long way. Preventing accidents I think is a great process. Make it hard to accidentally download malware.
But that's just for accidents. For people downloading things at work, that's what HR is for. If HR isn't doing its job, IT is helpless. At the end of the day, we are only as secure as HR makes us. If HR says malware is okay, bottom line malware is okay. Not your monkey, not your circus.
If you truly want to defend against malware, don't give users unfettered access to data. Don't let them treat their work machines like their home machines. Don't block them from doing sensible things or their jobs. Hire quality works, train them, trust them, fire them when they refuse. Treat them like adults, maybe they will act like them.
Malware is 99.99% a Windows with Active Directory and shared folders (mapped drives) problem. Essentially all malware depends on that combination of things. Not that any of those things is a problem on its own, but together they are one seriously big and easy target. Combine that with the Windows system admin ecosystem of distrusting MS updates, of MS not taking their own products seriously and making patching a nightmare, of accepting outrageously unprofessional software to be deployed into production environments and of course you get malware; companies are begging to be infected.
Choose any alternative and malware really isn't an issue. Coming from a company that works 100% in LAN-less, Windows-less, AD-less, mapped drive-less architecture and its easy to forget that malware and ransomware are actually things people have to worry about. That's not on the radar of modern networks. It's just not a real problem. I've never seen an environment for the last decade or so that got infected without doing crazy things that begged for it (turned off firewalls, disabled AV, replaced good AV with some scam product, didn't have HR say malware was bad, etc.) I still see malware once in a great while in customers, where people demand that there be little to no security. But even there, it's gotten pretty rare.
Minimal effort... good patching, don't run as admin, basic DNS filtering, sane HR policies with teeth, avoid windows, avoid AD, avoid mapped drives, supply what users need to work, good AV when on Windows, modern apps.... any number of items alone can be enough to essentially curb malware issues.
And of course, at the end of the day, malware is always a risk and the true strategy comes down to two things...
- Make malware a "background noise" issue. This is trivially easy. It's always a risk, but you can make it a minor one.
- Have good, true backups so that a malware event is minimally disruptive and you can recover instead of going into a disaster.
-
@scottalanmiller said in New customer - greenfield setup:
Anything you DO do, needs to actually be beneficial. That means actually improving your security. Anything that doesn't improve your security and/or actively makes it worse is a serious problem.
Yep, I agree with this. Knowning now how bad the vendors fail with the SSL interception, it's clear how and why that's horrible - on many levels.
So what do we do in general?
DNS filter - this is beneficial - prevents resolution to known bad sites and others blocked by the DNS filter.
Email filter - removes some/most bad links/virus laden files and spam/phishing
Local AV - additional scan locally for items missed by filters
All things already covered above.
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
-
@dashrender said in New customer - greenfield setup:
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
This comes down to a lot of factors. Is this a classroom setting where people have a focused 30 minutes to talk about this? Is it interactive? Does management make it clear that this is a high priority? Do people know that they will be accountable for this in practice?
-
@dashrender said in New customer - greenfield setup:
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
In my company, KnowBe4 has been really good. Users get yearly and quarterly videos and are encouraged to ask questions. Plus I setup a random monthly phishing scam test in addition to my very targeted bi-annual spear phishing tests I setup.
I really like it when users ask for help to decipher whether an email is phishing or not. We go over the potential red flags and if it is a Phishing test, I will let the user decide whether to click the link or not. 99% of the time they pass. If they click it, we have a small chat right then and there about what just happened.
Management only gets serious about it when they hear something in the news or through the client grapevine. Then its all hands on deck until.....
IMHO, it has been pretty effective when they see demonstrations of what is possible as compared to letting them read a PowerPoint, answer a couple questions and move on. Kind of like the great Medical - Fraud, Waste and Abuse presentation. All I hear is, "Ugh, anyone have the answers?" or similar statements.
-
@scottalanmiller said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
This comes down to a lot of factors. Is this a classroom setting where people have a focused 30 minutes to talk about this? Is it interactive? Does management make it clear that this is a high priority? Do people know that they will be accountable for this in practice?
Training during orientation is definitely focused.
The yearly sessions are normally group based - outside of normal work, mostly with people in a circle/arc of chairs and it is interactive.without saying "this is high priority - you must follow this" - I'm not sure how to answer the question.
As for accountability - no, not really. I mean, they are told to not surf pages during working time - but again, they are allowed to surf whatever during their lunches/breaks - so....
I also say - shit happens, it even happens to IT Admins - I don't expect most people to get fired over opening an attachment that has a virus, at least not the first time, and probably not even the second (luckily this is pretty rare in my experience - but it is still the primary way of being infected) so I'm not sure what the accountability would look like? -
@pmoncho said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
In my company, KnowBe4 has been really good. Users get yearly and quarterly videos and are encouraged to ask questions. Plus I setup a random monthly phishing scam test in addition to my very targeted bi-annual spear phishing tests I setup.
I really like it when users ask for help to decipher whether an email is phishing or not. We go over the potential red flags and if it is a Phishing test, I will let the user decide whether to click the link or not. 99% of the time they pass. If they click it, we have a small chat right then and there about what just happened.
Management only gets serious about it when they hear something in the news or through the client grapevine. Then its all hands on deck until.....
IMHO, it has been pretty effective when they see demonstrations of what is possible as compared to letting them read a PowerPoint, answer a couple questions and move on. Kind of like the great Medical - Fraud, Waste and Abuse presentation. All I hear is, "Ugh, anyone have the answers?" or similar statements.
Yeah, I've been asking for a solution like this for years. I even did one of their free tests, and the amount of people (and the specific people) who failed it was staggering (OK not really - come on, we know users). But the board just said - come on, can't you just train them? which I replied - no, I can't. it's not my skillset and the other features included in these packages would take ages for someone like me to develop, etc - they still said no.
Now fast forward to now - new CEO, new board members - those two groups have decided to buy into training solution because of other reasons.. and this solution does include some computer smarts type training.
-
@dashrender said in New customer - greenfield setup:
@pmoncho said in New customer - greenfield setup:
@dashrender said in New customer - greenfield setup:
User education is next thing - and we do provide user education at hiring and then once a year. I really wonder - for the average worker - how effective is it? I think the answer to this comes down to your employees themselves. Again, someone also already mentioned that as well.
In my company, KnowBe4 has been really good. Users get yearly and quarterly videos and are encouraged to ask questions. Plus I setup a random monthly phishing scam test in addition to my very targeted bi-annual spear phishing tests I setup.
I really like it when users ask for help to decipher whether an email is phishing or not. We go over the potential red flags and if it is a Phishing test, I will let the user decide whether to click the link or not. 99% of the time they pass. If they click it, we have a small chat right then and there about what just happened.
Management only gets serious about it when they hear something in the news or through the client grapevine. Then its all hands on deck until.....
IMHO, it has been pretty effective when they see demonstrations of what is possible as compared to letting them read a PowerPoint, answer a couple questions and move on. Kind of like the great Medical - Fraud, Waste and Abuse presentation. All I hear is, "Ugh, anyone have the answers?" or similar statements.
Yeah, I've been asking for a solution like this for years. I even did one of their free tests, and the amount of people (and the specific people) who failed it was staggering (OK not really - come on, we know users). But the board just said - come on, can't you just train them? which I replied - no, I can't. it's not my skillset and the other features included in these packages would take ages for someone like me to develop, etc - they still said no.
Now fast forward to now - new CEO, new board members - those two groups have decided to buy into training solution because of other reasons.. and this solution does include some computer smarts type training.
We have KB4 Gold package that is good enough for us. No need to go above that for the medical field IMHO.
