Server Message Block (SMB) protocol is used for communications within a Microsoft Windows-based network. SMB signing is a security tool that enables SMB traffic to be cryptographically signed. This protects the network from common man-in-the-middle attacks such as packet tampering. If SMB signing is not used, an internal attacker can essentially steal all share sessions that are active on your network.
There are multiple versions of SMB protocol available, namely SMB1, SMB2 & SMB3. Both SMB1 & SMB2 use signing for transport security, whereas SMB3 uses encryption for transport security.
SMB signing uses a hashing algorithm (HMAC SHA-256).
SMB signing is currently available on all versions of Windows. It’s enabled by default on Domain Controllers, since SMB is the protocol used by clients to safely download Group Policy information.
Navis recommends the following process for security signatures:
Evaluate the feasibility of enabling SMB signing across all the client and server hosts.
Consider testing on a limited range of hosts in a non-production environment before scaling up.
Take a note of any potential difficulties. One common drawback can be performance overhead due to the computation overhead in signing & verification of every packet.
Take inventory of machines that do not have SMB signing enabled.
If the result of testing is working as expected, then the setting can be applied in production.
SMB Signing Configuration and Defaults
Configuring SMB clients and SMB servers requires setting Group Policy and Registry settings. For details on how to configure SMB signing, you can refer to the following links:
Overview of Server Message Block signing (https://docs.microsoft.com/en-US/troubleshoot/windows-server/networking/overview-server-message-block-signing)
The Basics of SMB Signing (covering both SMB1 and SMB2) (https://docs.microsoft.com/en-us/archive/blogs/josebda/the-basics-of-smb-signing-covering-both-smb1-and-smb2)
How to Shoot Yourself in the Foot with Security (https://docs.microsoft.com/en-us/previous-versions/tn-archive/cc512612(v=technet.10)?redirectedfrom=MSDN)