Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Encrypting LAN traffic

Posted on 2016-11-16
4
Medium Priority
?
63 Views
Last Modified: 2016-11-18
Hey All,

My organization is interested in encrypting the network traffic on our LAN.  I'm looking for a little discussion about what, if anything, you all might be doing, why, and how.  Our goal in this part of the project is to prevent a hacker from (easily) getting anything useful, assuming that someone has hacked into our network and set up camp to lay low and sniff out our traffic for a while.  The goal is not perfection (is that even possible in security), but a layer of difficulty that could well be a deterrent.  So far we are configuring LDAPS where possible/needed, have set our internal web applications to use HTTPS, and are looking into encrypting any communication with our database servers (reporting, applications, and development).

Does anyone see anything that we are missing, may want to look into, or know of anything we should avoid doing?  Any and all insight is welcome and appreciated.
0
Comment
Question by:GileadIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 56

Accepted Solution

by:
McKnife earned 2000 total points
ID: 41890939
First: I have seen pentesters doing this. To receive traffic that is not for your IP, you'll have to spoof that IP. Doing that will result in extremely weird behavior on the end of the pc being spoofed. Extremely suspicious, so if anyone is using that PC, everything network related will be ultra slow. I mention this to make you aware that this sniffing is not easy, not the slightest bit.

Network traffic in windows networks can be encrypted in several ways. With servers of the generation 2012 or 2016 and clients win8.x or win10, the SMB file share traffic (SMB 3) is encrypted by default. If you run legacy systems (win7/Server 2008R2), you will need to setup ipsec to reach the same goal.
1
 
LVL 9

Expert Comment

by:Cheever000
ID: 41891983
I agree with the IPSEC comment above, you can build profiles to require traffic to be encrypted via IPSEC internally.  And to add if a hacker could gain access to the network equipment and set up a SPAN or Mirror port they would not need to spoof an IP address and can gain access to all traffic.
1
 
LVL 56

Expert Comment

by:McKnife
ID: 41892512
Sure, if there is a mirror port and the central switches are accessible physically - but who would allow that? :-)
1
 
LVL 1

Author Closing Comment

by:GileadIT
ID: 41892833
IPSec appears to be the best option for the solution.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read about achieving the basic levels of HRIS security in the workplace.
In this article, WatchGuard's Director of Security Strategy and Research Teri Radichel, takes a look at insider threats, the risk they can pose to your organization, and the best ways to defend against them.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Suggested Courses

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question