Encryption ask: is better to encryption all hosts or is enough server and proxy?

[andreaf-it]

Hello,
using a configuration server, proxy, various hosts. Implemented encryption on server and proxy and seems to work properly but I'm not sure if is better to ecryption also all hosts connected on proxy or if neccessary to encryption only server and proxy.

Best Regard
Andrea

[tim.mooney]

I would say that depends on your environment and how much you trust the network(s) between your agents and your proxy, as well as what kind of data is being sent to the agents as part of the item checks and what kind of data is being returned.

I think the general answer is that it's always better to use secure connections whenever possible, but when it's extra work to set up and debug secure connections, each environment has to make decisions about whether the risk is high enough to make it necessary to use encryption between any particular agent and a proxy or server.

One advantage to just deciding that all connections need to be encrypted is that you don't have to make a new risk assessment as your environment changes (new hosts, new potential dangers on a network where you have agents, new monitoring items that may require sensitive data or may return potentially sensitive data, etc.). If you default to not encrypting except for agents where there's sensitive data being exchanged, you have to keep thinking about "do I need to change this agent connection to be encrypted if I add this item?".