thoughts on this one greatly appreciated.
The challenge comes from information as provided by articles such as this one https://techcommunity.microsoft.com/t5/Office-365-Blog/Getting-the-best-connectivity-and-performance...
The step - Assess bypassing proxies, traffic inspection devices and duplicate security which is available in Office 365 is the concerning one.
So if we take a step back and analyse how this is reviewed by security architects.
The recommendation is that we bypass proxies and traffic inspection devices creates challenges around tenancy restriction
- This requires that we only allow from within the organisation access to their specific tenancy. The Microsoft way of handling this is to route the login page through a proxy which can perform the tenancy restriction and then the rest of the traffic can bypass the proxy (the pages that need to go direct however needs to be defined in a proxy PAC file which is considered by a lot of large orgs as onerous to manage).
- For the direct access piece , Microsoft supply a list of IP addresses that basically includes half of Azure that organisations are advised to allow all internal IPs access on a specified list of ports. Should an individual be able to bypass the proxy (hardly rocket science) they can then just go direct to whatever tenancy they want. This is a huge risk as many of these organisations have 3rd parties working on site that can now (should SSL inspection not be enabled) upload documents etc. out of the organisation bypassing all traffic inspection devices.
The crux of the matter is that going direct and not performing ANY inspection on traffic allowed go direct creates a massive hole and avenue for data leakage for any organisation.
An NGFW is typically an inline device that can operate as firewall, IPS, application control, url filtering etc. It can perform the SSL inspection inline in a way that cannot be bypassed. They can also have an integration with the Microsoft web service that provides all of the IP address updates automatically so that the gateways do not need to be manually updated whenever Microsoft changes/updated the IP addresses.
However, performing this inspection goes against what Microsoft recommends which means a possible large security hole will be created.
What is the right thing to do?
