Solved

Encrypting LAN traffic

Posted on 2016-11-16
4
49 Views
Last Modified: 2016-11-18
Hey All,

My organization is interested in encrypting the network traffic on our LAN.  I'm looking for a little discussion about what, if anything, you all might be doing, why, and how.  Our goal in this part of the project is to prevent a hacker from (easily) getting anything useful, assuming that someone has hacked into our network and set up camp to lay low and sniff out our traffic for a while.  The goal is not perfection (is that even possible in security), but a layer of difficulty that could well be a deterrent.  So far we are configuring LDAPS where possible/needed, have set our internal web applications to use HTTPS, and are looking into encrypting any communication with our database servers (reporting, applications, and development).

Does anyone see anything that we are missing, may want to look into, or know of anything we should avoid doing?  Any and all insight is welcome and appreciated.
0
Comment
Question by:GileadIT
  • 2
4 Comments
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 41890939
First: I have seen pentesters doing this. To receive traffic that is not for your IP, you'll have to spoof that IP. Doing that will result in extremely weird behavior on the end of the pc being spoofed. Extremely suspicious, so if anyone is using that PC, everything network related will be ultra slow. I mention this to make you aware that this sniffing is not easy, not the slightest bit.

Network traffic in windows networks can be encrypted in several ways. With servers of the generation 2012 or 2016 and clients win8.x or win10, the SMB file share traffic (SMB 3) is encrypted by default. If you run legacy systems (win7/Server 2008R2), you will need to setup ipsec to reach the same goal.
1
 
LVL 9

Expert Comment

by:Cheever000
ID: 41891983
I agree with the IPSEC comment above, you can build profiles to require traffic to be encrypted via IPSEC internally.  And to add if a hacker could gain access to the network equipment and set up a SPAN or Mirror port they would not need to spoof an IP address and can gain access to all traffic.
1
 
LVL 54

Expert Comment

by:McKnife
ID: 41892512
Sure, if there is a mirror port and the central switches are accessible physically - but who would allow that? :-)
1
 
LVL 1

Author Closing Comment

by:GileadIT
ID: 41892833
IPSec appears to be the best option for the solution.
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Most computer users do not realize how important their passwords are. Here’s the straight scoop on why you need a good password and how to create super strong passwords that are easy to remember and hard to crack. Thieves Are Trying to Steal Yo…
There are some basic methods for preventing attacks on, hacking of and unauthorized access to a network -- maybe not completely, but up to a certain level. Start with a well-reputed firewall and unified threat management (UTM) system -- a gateway…
This Micro Tutorial demonstrates using Microsoft Excel pivot tables, how to reverse engineer competitors' marketing strategies through backlinks.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now