Ask the Expert

How to prevent network sniffing and eavesdropping

My question is regarding eavesdropping. A client machine (Computer A) communicates with 2 servers (X and Y). The aim of the attacker is to gather the data sent to both servers. If an attacker wants to eavesdrop on both the connections (A - X and A - Y), I suspect he or she would most likely install a sniffer on Computer A. What other patterns of intercepting network data should our organization watch for?

    Requires Free Membership to View

You're correct: Installing monitoring software on the client system (Computer A in your example) is the easiest way to gather all of the information the attacker is seeking. However, there are several other ways this sort of information collection could take place. First, it would be possible to gather the same information by installing monitoring software on both of the servers. Second, the same information could be gathered by sniffing the network connection. Is the network between the client and servers entirely under your control? All of the network devices between the systems should also be considered as possible eavesdropping points.

How can these attacks be prevented? Protecting against monitoring software is a function of endpoint security: Be sure you know what devices are present on your network and that you carefully control the software that is installed on them. You can protect against network-based eavesdropping attacks by using encryption. For example, if the connection between the client and server is Web-based, use HTTPS-encrypted connections to prevent an eavesdropper from reading the content of the communication.

For more information:

This was first published in August 2009

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: