SSE Rollout in a Hybrid Financial Firm
A financial services firm has 1,200 employees, 60% hybrid, and 150 contractors. It uses Microsoft 365, Salesforce, and a core banking application in a private data center. The firm is deploying FortiSASE SSE for SWG, CASB, DLP, and ZTNA. Early findings: Teams calls lag when remote users are forced through a distant proxy; CASB API scanning found 37 unsanctioned SaaS apps, including a file-sharing service used by the marketing team; DLP is blocking internal emails that contain account-number-like strings; and TLS inspection breaks a mutual-TLS banking partner portal used by the treasury team. Contractors still use VPN to reach the data center. The CISO wants “inspect everything” but the treasury team says the portal cannot be fixed. The firm has a two-month window before audit and cannot disrupt quarter-end processing.
1. How would you scope TLS inspection and handle the mutual-TLS portal exception without abandoning the CISO’s intent?
Read the worked answer
Scope inspection by risk and technical feasibility, not by a blanket rule. Inspect general web traffic and unsanctioned SaaS categories, but create a narrow exception for the treasury portal based on destination, certificate pinning, and user group. Verify that the portal uses mutual TLS and cannot accept a proxy certificate; do not attempt to “fix” it during quarter-end. Compensate with destination allowlisting, device posture for treasury endpoints, CASB API visibility where available, and enhanced logging of metadata. Keep all other treasury web traffic inspected. Document the exception with an owner, expiry date, and review trigger. The CISO’s intent is reduced blind spots, not necessarily decryption of every flow. A blanket inspection rule that breaks quarter-end processing would push users to shadow workarounds, which is a worse risk. The judgement is to make the exception explicit, minimal, and auditable rather than silent.
2. Would you use CASB API mode, inline mode, or both for the unsanctioned file-sharing service and for sanctioned SaaS? Explain the decision.
Read the worked answer
Use both, with different roles. For sanctioned SaaS such as Microsoft 365 and Salesforce, API mode gives broad visibility, retroactive discovery, and policy enforcement on stored data without forcing all traffic through inline inspection. For the unsanctioned file-sharing service, inline mode is needed to block uploads or access in real time, because API integration may not exist or may not cover the marketing team’s use. Start in monitor mode to identify users and data types, then move to block for categories that violate policy. Do not rely on API alone for real-time exfiltration, and do not inline-inspect every sanctioned SaaS flow if it degrades Teams. The reasoning is that API and inline solve different problems: API is deep but not necessarily real-time; inline is immediate but costly. The marketing use case also needs a business conversation: if the service is required, sanction it with DLP and access controls instead of driving it further underground.
3. How would you tune DLP to stop false positives on account-number-like strings while keeping genuine data-loss detection?
Read the worked answer
Replace broad pattern matching with context. First, run DLP in monitor mode and classify the blocked messages by data pattern, sender group, and destination. If internal finance emails legitimately contain partial account numbers, use exact data matching or a validated pattern with checksum and length rules, and exclude internal-to-internal traffic only for approved groups. Apply a threshold, such as requiring multiple matches or a specific document label, before blocking. For external destinations, keep a stricter action: block or quarantine. Add user coaching for repeat false positives and a review queue for exceptions. The judgement is to tune by data type and direction, not to disable DLP. Also verify that the DLP engine sees the same identity and group attributes as the SSE policy; a mis-mapped group can cause broad blocking. Re-test with sample treasury and marketing messages before quarter-end.