I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on their accounts and do a lot of stuff there. The problem because I have port mirroring that sends all the regular traffic to my Snort VM, it is also intercepting users passwords and all other data.
The question I have is how can I stop somehow snort from having access to sensitive data from the traffic? Is this anyway possible? How other companies are doing it? The problem I have is if someone compromises that Snort VM somehow, or even employee who is responsible for monitoring that VM, then they can access all sensitive data, customers passwords etc.
edit: Currently user makes an SSL request(regular web application), my loadbalancer does ssl decryption and routes the traffic to application server. Everything from loadbalancer to application server is unencrypted.