zlacker

In my experience many companies simply filter based on port number. Run your external sshd/openvpn on port 80 and you're good to go. But of course that's going off topic since TFA is obviously about middleboxes actually intercepting and analyzing the traffic.

In truth though if you start considering your employees like the enemy it's just a never ending upwards battle, especially if your employees are comp-sci folks. You could tunnel SSH over HTTP or even DNS if you cared enough.

>>simias+(OP)
How does the threat model where employees are the enemy differ from the threat model where malware running inside the network is the enemy?

>>daxelr+Vy
You want your employees to collaborate with you avoiding and tracking down malware and potential leaks. If everybody is used to working around your restrictions you just make it harder for you to figure out what's happening when something goes wrong.

For instance if your policies are too restrictive people will use their smartphones more and more to access the internet. Then some will start doing work stuff on their smartphones and you lose all control. What do you do then? Forbid smartphones within the company? Fire everybody you catch using one? It's just an arms race at this point.

Sane security measures and some pedagogy go a long way. Easier said than done though, it's a tough compromise to make.