Most organizations will deploy a Web Proxy solution, but not intercept HTTPS traffic to do SSL decryption and inspection. This may be done for various reasons
* Not yet having a PKI infrastructure to manage the SSL browser certificates
* Perhaps the AD/GPO team doesn’t want to manage SSL certificate on the user PC
* Security teams may be weary about man-in-the-middle issues
* Maybe SSL interception just wasn’t a concern at the time.
Without doing SSL decryption and inspection our ability to filter or perform an action on HTTPS traffic is tricky unless the destination IP is known and added to a DENY rule on the proxy. The problem with doing this, is that it even if you are good enough to find the specific IP that is being misused over HTTPS, it is impossible to see what is going on inside the tunnel without SSL decryption and inspection, so you are just guessing on what is actually happening. It’s not a very exact science, and takes much more time that its worth to fight the issue.