Risk assessment issues

How would I be able to shutdown the NPF service upon exiting Wireshark?

by stopping it manually from an elevated DOS box (sc stop npf).

How can they securely be protected since they may contain confidential information

By encrypting it with your preferred tool (e.g. those mentioned by @Jasper).

BTW: Honestly, those 'findings' are 'level three' findings that usually go into a report only if nothing serious was found in an audit ;-)) I have seen similar things, as some (not so clever) customers are not happy to hear that there is no serious problem in their environment. They prefer to get a 'result' for the money they spent :-)) Well, obviously they get what they ask for.

Explanation:

Issue 1:

It will continue to run (and can be used to sniff network traffic) until the machine is shut down or rebooted.

Well, yes. But how hard would it be to simply start Wireshark a second time to capture data?? So, not NPF is the problem. The real problem is, that 'something' (Malware) or someone (bad user) would be able to misuse the NPF service. In both cases it's not the NPF service that poses a risk. It's that fact that either of the two (malware, bad user) has access to that system, which is probably due to a bigger security problem in your environment. So, the 'finding' of the auditor implies that it is possible to misuse the NPF service, but he/she does not explain why this would be possible and how to protect against those risks ;-))

Issue 2:

(.pcap-based Packet Capture files) often contain sensitive information such as routing information, IP Addresses, as well as cipher-capabilities

Well, yes. That's the purpose of a network troubleshooting tool and it is absolutely obvious that you need to properly protect that information. Unfortunately the 'auditor' mentioned only things that are totally uncritical.

such as routing information, IP Addresses, as well as cipher-capabilities (found in handshakes for encrypted protocols)

come on, that's all 'publicly' available information that needs no protection at all. He/She forgot to mention the more interesting things:

• user credentials (username/password)
• transmitted e-mails, documents, etc.

So, please ask your 'auditor' why he/she demands to protect irrelevant information, while he/she did not mention the things that really need protection !??! Or just forward my answer to him/her and ask for a comment :-))

Regards
Kurt

1. You could write a batch script that starts npf service and then calls Wireshark.exe, and stops npf service again when Wireshark quits

2. A couple of things you can do include: storing capture files in encrypted containers (TrueCrypt, PGP, 7Zip with password), or you could anonymize parts of the file using tools like pktanon, bittwiste or tcprewrite if the capture file cannot be guaranteed to stay within trusted boundaries.