(bright music)
- Welcome to Check Points Tech-bytes
Small Business Security Video Series.
2017 has been a busy year; the most recent R77l.20.70
release in November supports https inspection on our
714 small supply business appliances.
https inspection lets the appliance inspect
encrypted network traffic, this improves identification of
applications, URLs, exploits, viruses and bot communications
with remote command and control servers.
In addition, our sandboxing technology threat emulation
is able to inspect files for zero-day threats.
The appliance does https inspection in one of two ways.
Each https categorization or SSL, TLS inspection.
SSL was the early name and has been replaced
in the latest version of the protocol with the name TLS.
Transport Layer Security, in the appliance WebView eye
SSL refers to both SSL and TLS.
The default appliance setting is https categorization
which allows URL filtering based on the web server
certificate, to better understand the difference
let's do a quick review of https.
Before https the http network protocol connected
client browsers, like Internet Explorer, Chrome or Firefox,
to web servers over the internet.
Http traverses the internet in clear tech
so anyone intercepting the connection is able to view
the contents of the packets exchanged the
between the client and server.
This includes usernames, passwords and credit card numbers.
Today there is a shift from http to https,
where the "s" stands for secure.
https sets up an encrypted tunnel between the client
and server, anyone intercepting the connection
would only see what looks like random data.
There are some nice descriptions on the web
that describe how the connection is setup.
In short, let's summarize-the browser requests a secure
page from a site, for instance www dot google dot com.
The server sends it's SSL certificate,
a digital signature that verifies
it is indeed the intended site.
The browser checks the validity of certificate
against it's known trusted certificates stored.
To the user this is typically shown as a green lock icon.
If valid it replies back to the server.
The server sends back a digital signed acknowledgement
to start the encrypted session.
Further communication between the client
and server is encrypted, in short
this is how the connection is set up.
Using the appliance default setting it is able
to look at the URL end if needed.
The certificate to categorize the site and check
it against the URL filtering policy.
Https categorization doesn't inspect inside packets.
This is needed for advanced application analysis
and other security features to detect
threats in encrypted packets.
Https categorization also doesn't work for all sites
like those that use wild card certificates.
For instance, star.google.com sites like google
may use a wild card certificate for multiple sites.
This will be a problem for a policy that allows
viewing videos on YouTube but does not allow
access to transfer files to google drive.
In addition, the appliance notifies users
visiting a risky site by a user check message,
this requires a redirect to the appliance page.
But, doesn't work for https connections
with the https categorization settings.
To enable SSL inspection it is simple enough to set on
the appliance, simply click on SSL traffic inspection
and click apply to set the policy.
Now the appliance intercepts the connection.
It sets up an encrypted tunnel between the client
and itself using it's own certificate and
sets up another encrypted tunnel
between itself and the web server.
Before you click apply to enable SSL inspection
you will want to download and install the appliance
certificate on your protected client computer.
So, the client will trust the appliance certificate.
The appliance certificate is not
in the clients trusted certificate authority
store so this needs to be added.
If you don't do this step then the browser
warns the user that the connection is not
trusted and won't show the green secure icon.
We'll show how this done, let's first
review the SSL inspection bypass policy.
There are some cases where you want to
bypass the appliance https inspection.
First you may have a guest wireless network
that is un-trusted where you are not able
to add the appliance certificate.
Second, for privacy reasons we bypass connections
to health, government, military, finance
and well known update service.
These categories are not inspected,
this lets users connect to banks
and trusted applications like,
Microsoft, to apply updates as needed.
If you want, enable http tracking
to see the https inspection policy decision.
Either inspect or bypass, you can also
create your own exceptions and add
sites to bypass https inspection.
Click on exceptions, then click any category
and choose a category or choose new
to add a site or application.
Click advanced and you'll see the
appliance certificates stored that it uses
to verify the validity of the certificate
received from the internet web-server.
Now, let's review, the process on Windows tend
to add the certificate to the trusted
clients certificate authority so the
protected clients don't see browser warning.
For the overview of the process
return to the SSL inspection policy and click on more info.
From the protected computer click on download CA certificate
or manually copy the certificate file to the computer.
Locate the file and double click to open the certificate
click install certificate and follow the certificate
import wizard instructions to add the certificate to the
trusted root certification authorities repository.
Note this may not be the default repository
in the certificate import wizard.
Click local machine, click place all certificates in the
following store, locate and select the trusted root
certification authorities, click okay, click next,
click finish to complete the process.
This works for Internet Explorer and Chrome,
the directions are different for Firefox and Safari.
Follow the same procedure on your other protected computers,
then return the the 700 appliance and enable SSL inspection.
That's it, you've now improved identification of
applications in URLS, exploits, viruses, and
bot communications within encrypted
connections to sites on the internet.
In addition, our sand boxing technology is able
to inspect files for zero-day threats.
For more on Check Point Small Business Security,
please visit our checkmates user community
at community dot checkpoint dot com, thank-you.
(mechanical tech sound)