This article applies to:
- WebMarshal 6.1 upwards with HTTPS content inspection enabled
Question:
- How do I increase the security of sensitive information when using WebMarshal with HTTPS content inspection enabled?
Information:
WebMarshal provides the option to scan content inside secure HTTPS connections. When HTTPS inspection is enabled, It is important for users at an organization to know their HTTPS traffic and the temporary files associated with their HTTPS Internet activity are not accessible to others.
This article clarifies the potential availability of the scanned data and suggests some strategies to minimize any exposure.
Transmission:
WebMarshal HTTPS inspection ensures that all traffic to and from HTTPS URLs is encrypted - between the remote server and WebMarshal, and between WebMarshal and the client. Decryption is limited to a very short processing window on the WebMarshal server.
Caching:
WebMarshal 7.5.5 and above caches static files delivered over HTTPS by default, where permitted by the response headers.
- HTTPS caching can be disabled. See Trustwave Knowledgebase article Q21204.
Earlier versions do not cache any HTTPS material.
Inspection:
The WebMarshal administrator chooses which sites or URLS are inspected. Traffic to other sites is not decrypted.
Trustwave recommends that you limit inspection to sites such as webmail and social networking sites. Banking or other financial sites should generally not be inspected. You can use WebMarshal rules to choose which sites are inspected.
Logging:
Text logs or database logs could contain the names of files, as well as querystring data, from inspected material.
To mitigate any chance of data mining from these logs, you can choose not to log data from inspected HTTPS requests. See Q12055: How do I exclude HTTPS requests from reporting?
Disk drive forensics:
WebMarshal "unpacks" the web traffic using temporary folders on a local disk drive. Normally these files are deleted and the drive space released within seconds. WebMarshal uses the drive very heavily and will re-use space quickly, but in theory, "deleted" material in the file system could be accessible later.To mitigate this theoretical risk, you could encrypt the temporary folders (and the Traffic Logs if in use).
- Note that encrypting disk folders significantly affects performance.
Follow the instructions below to encrypt the logging folders that WebMarshal uses to store the HTTPS related data. Repeat these steps on each processing node.
- Create a Microsoft Windows account and set the WebMarshal services to use the account.
- Log off and log on again under the the new WebMarshal account.
- In the WebMarshal directory right click on each of the subdirectories in the list below, and select Properties.
NOTE: For a list of default WebMarshal install locations, see article Q20952. - \TrafficLogs
- \Temp\unpacking
- \Temp
- Click the Advanced button and check the box Encrypt contents to secure data.
- Click OK and OK again. Select Apply changes to this folder only.
- Click OK and OK again.
An alternative solution is to purchase a third party RAM disk and when installing WebMarshal assign the directories mentioned above to the RAM disk. Once this has been done the directories can be encrypted the same way as described above.
The RAM disk is ideal in this situation because when it is restarted any data on the disk is deleted and cannot be recovered using data recovery software.
If you have already installed WebMarshal you may need to re-install to change the directories that can only be chosen during setup.
