TLS decryption is absolutely amazing.
So we can have application visibility and control,
but we don't want to decrypt every possible TLS session
and that's because Bob the user or some other user going
to their personal banking website,
we don't want to decrypt that information
because it's sensitive and personal to Bob,
including passwords.
And so forth.
So in this video, I want to do two things.
Number one, I want to share with you how
we can control the decryption policy,
and second and probably more important,
I want to walk you through how we
can verify that the decryption is working or not WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can verify that the decryption is working or not
working as expected on the Web Security Appliance.
So with the HTTPS proxy services enabled,
here's where we go to go and set up the decryption policy.
It's under Web Security Manager, and then under Web Policies,
we have a separate item right here for decryption policies.
So we'll click on decryption policies.
So here into the Decryption, Policies we have a default
global policy, which says decrypt.
So if we wanted to, we can modify this default policy
or we could add a policy.
And we could put it on top of or in front of this global policy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we could put it on top of or in front of this global policy.
So let's make one just for Bob, as an example.
So we'll click on Add Policy and we'll
call this "Decryption Policy One," as in our first one
we're making here together.
We're going to put it on top of or in front
of the global policy, and then we
can scroll down and put in the details.
So we can have it applied just to a specific identification
profile or all profiles.
And so if we want to be granular,
we can select the identification profile
that we created earlier, which is our profile one,
and then let's go further and just apply this to Bob. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then let's go further and just apply this to Bob.
Just an example of how granular it can be.
So we'll put Bob's username in there, click on Done,
and let's confirm our work.
So we have a Decryption Policy One ,
and we're looking for just the user called Bob from this
identity profile called OurProfileOne.
And we're not putting any additional constraints on it
down here.
So we'll click on Submit.
And now that we have this new policy that's
going to be hit first and match on Bob,
we also want to specify what we do not
want to go ahead and do decryption for.
So in this policy called Decryption Policy One,
now let's go specify that we don't want to do decryption WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
now let's go specify that we don't want to do decryption
based on the category of URL.
So we'll click on the Global Policy option
here because by default, that's what we're using.
And let's specify that for auctions-- let's go ahead
and take auctions.
So that's right here.
So let's say pass through as opposed to decrypt,
and let's also go ahead and do financial institutions as well.
So we'll go down to finance, which is right here.
We'll say pass through.
So the default is decrypt everything.
So now with this policy in place,
traffic from Bob that's headed to a finance category URL
or auctions category URL-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or auctions category URL--
now for those categories of URLs,
it's going to be passed through and not decrypted.
So it's going to bypass the decryption function on the Web
Security Appliance.
So we'll scroll all the way to the bottom
here and click on Submit.
Very important.
So there's our decryption policy with two passwords, one
for finance, one for auctions.
And if you we want to apply that change,
we'll go ahead and click up here on the right hand
corner, Commit Changes.
And we can add a comment to this commit.
I'm going to go ahead and just commit it without a comment.
And while that's committing, let's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And while that's committing, let's
talk about and remind ourselves about why the TLS decryption is
important.
If the user's is using HTTPS with some flavor of TLS
and going through the WSA, the WSA
doesn't really have access to look at the application layer
data.
So if we're trying to control an application
and the WSA can't see it because it's all encrypted,
that's a problem.
So the Web Security Appliance steps in the middle
and builds TLS sessions-- one between itself and the client,
and one between itself and the real server.
And by doing so, it can see that traffic
and have better insight into what's
going on at the application with a better chance of enforcing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going on at the application with a better chance of enforcing
our application control regarding
an application that we want to deny or not allow for the user
to access over the web.
All right.
So the commit has been done.
Let's go ahead and test this out from our client computer.
So here's our client computer and let's open up a browser.
I'm going to go ahead and bring up
an incognito window in Chrome.
And let's go to google.com.
We'll authenticate as Bob.
This is the WSA saying who the heck are you
based on the way we have a set up and we're there.
Now one of the important aspects I want to share with you WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now one of the important aspects I want to share with you
right now is, how do we know that the Web Security
Appliance is actually doing the TLS decryption.
And here's how we can know.
If we click on the little lock next to google.com--
so I went to google.com it redirected me to HTTPS
and it's saying the certificate is valid,
the connection is secure, but if we click on the certificate,
check this out.
Look who it's issued to.
It's issued to google.com, but it says
it's issued from wsa.ogit.com.
And the reason the client's accepting this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the reason the client's accepting this
is because as part of our enterprise route certificate,
the clients are already set up to trust
the CA and the subordinate CA, so that if it
does get a certificate signed by wsa.ogit.com,
it says, yep, I trust that certificate authority
and I'm accepting the certificate.
And that's happening because the decryption
policy is applying to everything except for and auctions.
So let's do this.
Let's search for auctions.
So let's grab one of these.
I'm going to grab www.ha.com and it should work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to grab www.ha.com and it should work.
We have no filtering in place for that.
But if we go to the certificate--
so we have an HTTPS session--
we click on the little lock here and then look
at the certificate and click on it,
it says it was issued by DigiCert, by a PKI provider.
That's because we told our Web Security Appliance
that anything going to auction sites or finance,
do not bother doing the TLS decryption.
Let's try another one.
Let's go to paypal.com.
That would be related to finance for sure.
So this site, paypal.com in the finance category, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this site, paypal.com in the finance category,
click on the lock and go to certificate,
it's also issued by PKI certificate authority.
So if we go to anywhere else.
In fact, let's go to CBT Nuggets.
Go to cbtnuggets.com and look at the lock there
and click on certificate, it says
it's issued by wsa.ogit.com.
So everything except for finance and except for auctions
will have the TLS decryption applied to it
at the Web Security Appliance.
I think they get the benefit of that
is we want the Web Security Appliance to have application WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is we want the Web Security Appliance to have application
visibility, so it can stop or deny the applications
that we don't want to go through the Web Security Appliance.
In this video, we've identified how
we can set up a decryption policy
and specifically tell the Web Security Appliance to not do
TLS decryption based on the category of website that
is going to, such as finance
So thanks for joining me in this video.
I'll see you in the next one.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.