?
Solved

Encrypting LAN traffic

Posted on 2016-11-16
4
Medium Priority
?
60 Views
Last Modified: 2016-11-18
Hey All,

My organization is interested in encrypting the network traffic on our LAN.  I'm looking for a little discussion about what, if anything, you all might be doing, why, and how.  Our goal in this part of the project is to prevent a hacker from (easily) getting anything useful, assuming that someone has hacked into our network and set up camp to lay low and sniff out our traffic for a while.  The goal is not perfection (is that even possible in security), but a layer of difficulty that could well be a deterrent.  So far we are configuring LDAPS where possible/needed, have set our internal web applications to use HTTPS, and are looking into encrypting any communication with our database servers (reporting, applications, and development).

Does anyone see anything that we are missing, may want to look into, or know of anything we should avoid doing?  Any and all insight is welcome and appreciated.
0
Comment
Question by:GileadIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 56

Accepted Solution

by:
McKnife earned 2000 total points
ID: 41890939
First: I have seen pentesters doing this. To receive traffic that is not for your IP, you'll have to spoof that IP. Doing that will result in extremely weird behavior on the end of the pc being spoofed. Extremely suspicious, so if anyone is using that PC, everything network related will be ultra slow. I mention this to make you aware that this sniffing is not easy, not the slightest bit.

Network traffic in windows networks can be encrypted in several ways. With servers of the generation 2012 or 2016 and clients win8.x or win10, the SMB file share traffic (SMB 3) is encrypted by default. If you run legacy systems (win7/Server 2008R2), you will need to setup ipsec to reach the same goal.
1
 
LVL 9

Expert Comment

by:Cheever000
ID: 41891983
I agree with the IPSEC comment above, you can build profiles to require traffic to be encrypted via IPSEC internally.  And to add if a hacker could gain access to the network equipment and set up a SPAN or Mirror port they would not need to spoof an IP address and can gain access to all traffic.
1
 
LVL 56

Expert Comment

by:McKnife
ID: 41892512
Sure, if there is a mirror port and the central switches are accessible physically - but who would allow that? :-)
1
 
LVL 1

Author Closing Comment

by:GileadIT
ID: 41892833
IPSec appears to be the best option for the solution.
0

Featured Post

Bringing Advanced Authentication to the SMB Market

WatchGuard announces the acquisition of advanced authentication provider, Datablink, with one mission – to bring secure authentication to SMB, mid-market, and distributed enterprises with a cloud-based solution, ideal for resale via their established channel & MSSP community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Using in-flight Wi-Fi when you travel? Business travelers beware! In-flight Wi-Fi networks could rip the door right off your digital privacy portal. That’s no joke either, as it might also provide a convenient entrance for bad threat actors.
Transferring data across the virtual world became simpler but protecting it is becoming a real security challenge.  How to approach cyber security  in today's business world!
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Visualize your data even better in Access queries. Given a date and a value, this lesson shows how to compare that value with the previous value, calculate the difference, and display a circle if the value is the same, an up triangle if it increased…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question