Hello, welcome to the Friday, July 19th, 2019 edition of the Sansonet Storm Center's Stormcast. My name is Johannes Ulrich, and I'm recording from Svindon, England.

One technology to better control who is able to connect to your network is 802.1X, and with that, it directly applies to critical control number one which has its

focused an inventory of all systems connected to your network. Now implementing 80.1 is often a daunting

task and a lot of administrators are shying away from it.

Now, to help you a little bit out here, Rob has today published some tips

how to implement 80.1X in a Windows environment.

So if you're interested in this, take a look at it and see if this will help you implement this technology.

And when it comes to TLS, probably the simplest way to intercept TLS is to get users to accept your certificate authority

and then to set up a proxy that will intercept

TLS connections. Now, there have been many attempts over the years to do this on a large-scale

country level. And back in 2016, Kazakhstan made news by actually trying to have its certificate authority added as a trusted

certificate authority to browsers. While that attempt failed, they just recently now started

to mandate that users in Kazakhstan will add their certificate authority, their country level certificate authority

to browsers in order to allow for traffic inspection. There has been some discussion and a link to

that in the show notes on the Mozilla security list, how to respond to these kind of actions. Now one option of course would be for

browsers to blacklist these certificate authorities so even if a user adds them

manually they wouldn't really work. Certificate pinning while it's no longer really

in use would potentially offer a solution

here but turns out that browsers who did implement certificate pinning did allow the override

for certificate authorities that users specifically installed.

Looks like so far a compromise that may be developing here is to just add a more prominent

visual indicator if such a certificate authority is used to verify a particular site, essentially

...