Https filtering

mrbzumrbzu · ‎06-07-2010

Hi All,

How the enterprzes are doing the https filtering? for the https filtering, you need to decrypt the packet to evaluate its contents for the filtering and if you do it then its like a man in the middle attack. There are devices available to do the https filtering doing deep packet inspection technology but how they cope with the legal legislation for financial sector. like people are using https bank sites to made transactions and if you are decrypting the packet then you will act like a man in the middle. Correct me if i am wrong. your explanation on this will be much appriciated.

Regards

Panos Kampanakis · ‎06-07-2010

There are 2 ways to do https filtering:

- You can do reverse dns. For example if a host is going to an ip address on port 443, you can do reverse dns and see the domain of that ip and allow it or not. Devices like that are filtering devices that the ASA supports. Sch methods don't proxy as a man in the middle.

- You can be a man in the middle as you are saying. One of the first devices that introduced this functionality is the Ironport WSA. Of course having the mad in the middle introduces the concerns that you mention. But if you trust the certificate of the device that proxies then you can trust the transaction also.

I hope it helps.

PK