What does a network sensor see when a laptop comes back to the office after a trip?

Everything the laptop does once it is on a monitored segment, which is exactly when a compromise picked up on the road becomes visible. Malware installed in a hotel or through a fake update usually calls home at regular intervals, looks for other hosts or reaches for file shares and admin services. A sensor on a SPANSPAN: switch port analyser. A switch setting that sends a copy of network traffic to one port, where a sensor can watch it. or TAPTAP: test access point. A small device that copies the traffic on a network cable for a sensor to watch. port sees those connections from the first minute, and NetSenX flags beaconing, scanning, lateral movement and unusual outbound volume on every plan. What it does not see is what happened during the trip: traffic on the hotel network never crossed yours, unless the laptop runs the NetSenX agent, which watches its connections wherever it is. A sensible routine after travel to high-risk destinations: let endpoint protection run a full scan, apply pending updates, and change passwords if the device was out of your sight, for example at a border check.

← All 40 questions on Remote work and exposed servicesAll topics