3

I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)".

By default, this option should be Disabled on Windows machines but all computers that we receive from the vendor has this feature Enabled, so I can only assume that it is intentional. In order to backup to a NAS, I had to disable this feature.

My question is what might the security concerns be considering that this machine is on a local network where an industrial process is being controlled. From Microsoft's website, I get the impression that it prevents man-in-the-middle attacks that modify SMB packets. Is this the full story?

Improve this question

1 Answer 1

Reset to default
0

Indeed, Microsoft Technet lists MITM prevention as the sole use of this setting. And a digital signature does just that: to prove the authenticity of a digital message. If your network is trusted and MITM scenarios are really (!) not possible, it can be disabled.

Apparently there's also a performance decrease involved when it's enabled. So, if you're disabling it for performance reasons: you're trading performance for security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .