3

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on their accounts and do a lot of stuff there. The problem because I have port mirroring that sends all the regular traffic to my Snort VM, it is also intercepting users passwords and all other data.

The question I have is how can I stop somehow snort from having access to sensitive data from the traffic? Is this anyway possible? How other companies are doing it? The problem I have is if someone compromises that Snort VM somehow, or even employee who is responsible for monitoring that VM, then they can access all sensitive data, customers passwords etc.

edit: Currently user makes an SSL request(regular web application), my loadbalancer does ssl decryption and routes the traffic to application server. Everything from loadbalancer to application server is unencrypted.

|improve this question
  • I have rolled the question back to the version people have answered. Your latest edit removed most meaning from the question. – Rory Alsop♦ Dec 6 '15 at 9:52
2

If you are able to define how sensitive data look at the network layer then you might do it. But there is no "sensitive data" flag or similar attached to the packets so usually one can not detect at the network layer what is sensitive or not.

The problem I have is if someone compromises that Snort VM somehow, or even employee who is responsible for monitoring that VM, then they can access all sensitive data, customers passwords etc.

Even if you don't log the data from Snort the attack scenario is still there because all of these sensitive traffic can be accessed for anybody having access to the VM - even if Snort is not running. If this traffic would not reach the system then Snort would not be able to analyze it. If it reaches the system others can access it to.

Thus, if you fear that the Snort VM gets compromised somehow then don't forward any sensitive data to it. This of course means that you first have to know what is sensitive and second that you accept that Snort will not be able to analyze this traffic then.

|improve this answer
  • 1
    @Fransious: It is impossible to make Snort analyze data but anybody else having full access to the machine not having access to the data. See edited response for more details. – Steffen Ullrich Dec 4 '15 at 12:11
  • @Fransious: I don't know your setup but I don't think it is common that every traffic gets stored. Instead it gets just put into the IDS, analyzed and alerts get generated. There are probably cases where somebody wants to save everything (which is not part snort) but that can be done encrypted were the decryption key is not available on the system itself. Apart from that everybody who has access to the network between load balancer and application server or to the application server itself can get the data, so Snort is not really special here. – Steffen Ullrich Dec 4 '15 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.