I've been looking at several data leak/loss prevention suites but, in their documentation, I'm unable to find how they treat HTTPS.
One of the 'leakage vectors' is sending information to webapps through HTTPS. In which case, the only way to detect the leakage would be to decrypt it.
But, to do that, it would have to impersonate the remote server, using fake certificates, like a man in the middle attack. To avoid users being suspicious or complaining, I guess the coroporation needs to insert their certificate as a valid CA on the company owned devices' browsers.
My questions are:
- Has anyone first-hand experience on this kind of scenario? Can you tell us how do you implemented it?
- Am I right or is there another way of managing HTTPS (for example, detecting the data in use at the desktop level with an agent)?