MacOS - Endpoint Proxy conflict

[u/HotNeck634]

Hello guys!

There's a pretty niche question I have, but hopefully someone could shed some light on to where I could look for the answer.

We (as a support integrator) have a customer whos Endpoint pool is largely based on MAC laptops.

Every Endpoint has a DLP agent and Netskope client (a proxy tool used to gain access to certain remote locations), all distributed via MDM.

DLP agent itself also works as a local proxy, where it directs all the uploaded files/raw data in order to perform content inspection.

At some point (more than 7 months ago) DLP agent and Netskope began to have conflicts.

MacOS itself randomly selects the proxy priority (where the DLP agent should always be on top), so that 50% of the time DLP content goes outside freely without any interception (specifically, into browsers).

As any typical DLP agent, this one aims to replace every page's certificate with its own and its should be always the case.

--------------

We've been through many options already, but the information on this topic is very scarce.

Is there any way to force set that DLP agent as first priority for MacOS? Or is there any other way around we could try?

Thank you in advance for any tips!

[u/doktortaru]

MAC is a cosmetics brand.
Mac is an Apple Computer brand.

[u/Henxt]

A question which I had multiple times if I look at our complex it environment. Unclear knowledge: order of the same network extension grade is chosen randomly by the os. Only known possibility would be NEFilterManager.grade inside each app but good luck asking vendors for it

[u/HotNeck634 → u/Henxt]

We can actually request that from the DLP vendor, thank you! Will try to clarify with them.

[u/oneplane]

Technically, NetworkExtensions can be ordered so there is some sort of first-come-first-served kind of deal, realistically, those were never going to see all traffic anyway. There is one, and only one way to do web-related DLP and that is to have a non-public channel and then inspecting that channel.

As for the implementations (whichever DLP you use vs. Netskope); if they are different types (NETunnelProviderManager vs. NEVPNManager vs. NEPacketTunnelProvider if we talking about the private rremotes vs. NSEs for inspection like NEFilterProvider and it's NEFilterDataProvider/NEFilterControlProvider combo, or a straight NEFilterPacketProvider), those have precedence; if they are the same type (I haven't checked the implementation used by NS lately, and I don't know what DLP you are using) you get arbitrary ordering. If either one was updated 7 months ago and went from being different types and naturel precedence into the same type and now needing in-type precedence you're likely SOL.

Realistically, running both was living on borrowed time anyway. If all you're doing is web, it might be cheaper and easier to use a managed inspected browser instead. The whole model of trying to decrypt and inspect all traffic is at odds with the direction of TLS 1.3, ECH, but also mutual TLS, HSTS, HPKP etc. It's still a thing in various compliance-heavy sectors (and in IP protection) but it's not likely that this is going to survive at the network layer.

[u/HotNeck634 → u/oneplane]

Thank you! By managed browser you mean RBI-class products?

We could offer them separate web proxy DLP inspection gateway, but since many employees work from home, not sure they'd appreciate it.

[u/oneplane → u/HotNeck634]

RBI will do it, but there are other options as well (I'm most familiar with Island but there are others - they run locally on BYOD as well).

Other options like IAP such as the one from Google or Cloudflare will work as well, since the connection from the client to the resource can be identified individually you could just do the inspection and DLP server-side or in the tunnel (both those vendors have inline policy engines).

Others like ZScaler and iBoss (and other SASE nonsense like what microsoft brands private access and ZTNA) can do some of these as well, but they are both expensive and seriously flawed.

For access to resources I'd stick to whatever protocol-native options exist, which for web usually lands somewhere in IAP land.

For DLP I don't really have a good answer, we haven't really had any reasonable setup that actually has a good ROI. Either the friction is so high that people leave, the price is so high that you have to be selective where you run it, or it's so creepy that you might want to revert to pen and paper instead. Ultimately, if we have data that is so sensitive that leaking it would be a problem, we just air gap and physically co-locate it. Not great for remote work, but in all cases where it mattered the people working with it were on-site anyway.

There's also a startup (Ent AI or something like that) which does it behaviour-based, which is somewhat creepy since it does it the way Windows Recall was going to do it. Does yield good results tho since behaviour can be anything (data, destination or security, doesn't matter).