My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft.

It would appear that this policy also performs a man in the middle attack on HTTPS traffic. What this practically means for me is visiting "https://google.com" will give me a certificate error. Upon inspection of the certificate it is signed by my company's (self-signed) certificate.

To me this is hurting security in one area to help it in another. Is this common practice in big companies? Can someone point me to an ISO standard?


  Is this common practice in big companies?


Yes. The feature is available in most enterprise firewalls and also several firewalls for smaller companies. It is even available in the free web proxy Squid. And several personal firewalls have implemented it too.

As more and more sites, (both harmless and harmful), move to https://, expect that the usage of SSL interception will increase too, because nobody likes to have a firewall which fails to protect a system because it is blind regarding encrypted traffic.


  Can someone point me to an ISO standard?


SSL interception just makes use of the existing SSL and PKI standards. There is no need to have a new standard which defines how SSL interception works.

As for the Cyber Security Standards: I'm not aware of any which explicitly require SSL interception, but I don't have much knowledge of these kind of standards. But even if it is not explicitly required it might be implicitly expected that you either block access to a SSL site or do SSL interception when the standard demands traffic monitoring.


  will give me a certificate error. 


SSL interception needs you to trust the intercepting CA. In most companies these CA certificates are centrally managed and installed on all computers, but if you use a browser like Firefox it might not help because Firefox has its own CA store and does not use the systems CA store.


  To me this is hurting security in one area to help it in another. 


Yes, it is breaking end-to-end encryption to detect malware and data leakage which use encrypted connections. But since the breakage of end-to-end encryption is done in full control of the company and you still have encryption to the outside world this is a trade off most companies are willing to take.

But note that in the past bugs were detected in several SSL interception products (like same CA between different companies, no revocation checks...) which additionally weakened the security.
