HTTPS Decryption Vs HTTPs Filtering

[CyBeRkId2002]

Hi all.

 

Trying to get my head around this HTTPs lark and make sure some broadband I am helping to deliver for a handful of primaries is both user-friendly and meets safeguarding standards and aims.

 

Now, the schools range in size from 50 students (no server/Ad) to 400-ish students. None have, at present segregated Vlans and/or IP ranges for guest traffic.

 

My vision was for this setup:

 

• Default connection has HTTPs Decryption disabled. This should be no less secure than what they are using now with basic filtering from other providers
  
• On school owned devices (particularly child facing) certs would be installed and traffic decrypted using SSL proxy either manually configured or via GP where available
  
• Guests would then have 0 config and still be filtered to a reasonable level
  
• 
  

 

Firstly, does the above seem reasonable?

 

Secondly, is my assumption that just because I want HTTPs disabled it shouldn't mean a free for all on any HTTPs sites? I have been advised all of these would now be accessible but I would have assumed they should still be filtered based on URL, even if the contents cannot be viewed.

 

Any advice or pointers on the above, and where the security risks lie, would be very much appreciated.

[Securly_Chris]

Hi,

 

Sounds like a reasonable setup to me, guest or unmanaged devices always pose a problem when trying to do HTTPS decryption since they won't trust your filtering providers CA certificate but you can still provide basic filtering experience without HTTPS decryption. For devices that children have access to, particularly primary age I would recommend they all have decryption enabled as they will need the full protection provided by content analysis, monitoring, and URL filtering.

 

Only the domain is visible outside of encryption (Via DNS, SNI in the headers or via the certificate exchange), the full URL is not visible so you'd have to block the entire website not just the specific pages. (all wordpress.com rather than just wordpress.com/dodgydavesblog/ ).

 

Also if an HTTPS website is blocked and the device doesn't have the filtering CA certificate you will usually find you get a web browser security error rather than a more friendly blockpage message since that can't be injected either.

 

I know some places have provided a whitelist only guest network but with a link on their homepage how to install the CA certificate and join the fully filtered WiFi if they need access to other websites.

 

HTH

Chris

[AlanD]

You may need to think about how devices/users are identified. Its not much use having a safety report the next day to say that a user repeatedly went to http://www.sex.com (or tied to) if you have no way to identify the user or device (dynamic IP).

So for a school without AD, you might use google login for identification...I think RM Computers use a "free" cut down version of their Unify product for their filtered broadband service. Or you might simply log which user uses which device in a classroom...

 

I'm not a fan of any "default" or guest network that has unfiltered access in a school. Either they load the certificate - or they don't use the network. And I certainly wouldn't allow externally (non school owned/locked down) brought in devices to connect to be "default" network in any shape or form.

[Opendium_Steve]

Now, the schools range in size from 50 students (no server/Ad) to 400-ish students. None have, at present segregated Vlans and/or IP ranges for guest traffic.

 

• Default connection has HTTPs Decryption disabled. This should be no less secure than what they are using now with basic filtering from other providers
  
• On school owned devices (particularly child facing) certs would be installed and traffic decrypted using SSL proxy either manually configured or via GP where available
  
• Guests would then have 0 config and still be filtered to a reasonable level
  

 

Sounds reasonable - I'm assuming no BYOD (or at least, no child owned BYOD)? Coz IMHO you do need to intercept kids' traffic.

 

Secondly, is my assumption that just because I want HTTPs disabled it shouldn't mean a free for all on any HTTPs sites? I have been advised all of these would now be accessible but I would have assumed they should still be filtered based on URL, even if the contents cannot be viewed.

 

Depends on the filtering system you're using (you don't specify what you've got).

- The filtering system always knows what IP address a client is connecting to, but that isn't usually a lot of help.

- If your filter supports a passive HTTPS inspection mode, it will know what host name they are connecting to by examining the server name indication sent by the client and can filter based on that (beware though: this is information sent by the client and can therefore be spoofed. You're probably not going to be able to stop people using VPNs.) No certificates required for this. It also won't know the path part of the URI, so forget being able to do stuff like block the BBC games site at the same time as allowing the rest of the BBC.

- Full on active HTTPS interception lets the filter see the whole request and is obviously the best option if possible. Requires a certificate installed on each client though.

 

And yes, as has already been pointed out, think carefully about how you identify users. Kerberos single signon is probably the best option for schools with AD, but for everyone else you're probably going to have a separate pop-up proxy authentication box each time a user logs on to a machine. (KCSIE says what is "appropriate" is down to a risk assessment, but the UKSIC guidelines specifically say you should identify users, so...)

Edited October 15, 2018 by Opendium_Steve

[Netsweeper]

Hi,

 

One misconception on decryption is that you can't filter HTTPS sites if you're not decrypting. That is not true. A capable web filtering solution will be able to block HTTPS sites at the domain/hostname level without decryption, it typically identifies the sites using SNI or Reverse DNS lookup if the SNI is not available.

 

Decryption is only needed if you want to block/allow HTTPS pages at the URL level e.g. allow specific YouTube videos only. Decryption will also allow the filtering system to analyze the encrypted content for duty of care and security purposes. But a good filtering database will already have URLs for virus, malware, phishing, extremism, hate speech and other negative content that you should block by category for security & safeguarding purposes.

 

If you want to a different policy for students vs staff (without having authentication), then you can segment the network by IP (and Wifi SSID) and set the policy accordingly in the filtering system.