adammontville
commented
5 years ago Inputs:
- SI: Software inventory
- List of authorized sites not requiring decryption before analysis
Operations:
- Enumerate each boundary proxy system
- For each identified proxy system, examine its configuration as follows, noting appropriately and inappropriately configured systems:
- Encrypted network traffic is decrypted prior to analysis, when traffic is not related to an authorized site
- Enumerate the set of appropriately configured proxy systems
- Enumerate the set of inappropriately configured proxy systems
Measures:
- M1 = List of boundary proxy systems
- M2 = List of appropriately configured boundary proxy systems
- M3 = List of inappropriately configured boundary proxy systems
- M4 = |M1|
- M5 = |M2|
- M6 = |M3|
Metrics:
- M5 / M4 = Ratio of appropriately configured boundary proxy systems to the total number of boundary proxy systems
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic.