It really depends on your use case. Most apps secure sensitive traffic at Layer 3 using SSL, including Internet traffic, email, local websites and databases, etc. What’s left on most LANs are traditional peer-to-peer or server-client traffic that may or may not be encrypted (file servers, VoIP, cameras and access systems, etc.).
In a previous job, we had lots of lit circuits, where the customer (a cell phone provider or other large business) would hand off a connection to us, we’d haul it over our network at Layers 1+2, then hand it to them at the remote end. In the middle would be conversion from 1G to 10G, multiple VLAN tags, conversions from 1310nm or 1550nm to any number of DWDM wavelengths, then back again. We didn’t run encryption on any of it, and I doubt they did too (carriers maybe, businesses probably not). But then, there may have been a lot of that going on on their side at Layer 3 that we didn’t know (or care to know) about.
With lit services, it would have been relatively easy for us (the telco) to put the port into mirror mode and monitor things without the customer knowing. (Mirroring is done all the time for testing and circuit validation). Part of your job as the provider is to maintain your customer’s security. If you don’t trust the provider to securely handle your service (locked buildings, monitored circuits, cameras, proper employee training, etc.), then you don’t use them, or you encrypt at Layer 2 and take the performance hit.
That all said, this is dark fiber, i.e. you’re the only one with electronics on the pair. So the provider’s primarily responsible for physical access. It’s not an easy task for someone who isn’t familiar with your setup to do all of the following:
- Find the fibers you’re using
- Find a spot where there isn’t a jacket on the fiber
- Attach a laser-detection device that grips each fiber just enough to see if there’s light on it without completely stopping the flow of traffic (difficult)
- Said device has to be able to decode whatever laser(s) you’re using (any wavelength, transmission rate) and capture Ethernet packets (super expensive, if it exists)
- Do this undetected by any human at either end or anywhere along the telco route (nearly impossible unless they’re an insider)
For somebody to be able to successfully pull this off, they’d have to be an insider, either from your company or from the provider, and would need intimate knowledge of everything about the connection: laser wavelength and modulation, locations of splice points and handoffs, and the aforementioned equipment. Or they’d have to be a government with all the spy movie gadgets. Even then, your lasers would detect a drop in signal levels if somebody so much as put a light finder on a fiber. (You can’t see light on glass unless it’s bent enough to force some of it to jump the core, which causes loss.)
Unless you believe your company could be targeted by high tech government types or untrustworthy employees/contractors, I’d say running security at Layer 2 may be overkill. (Honestly, if an outsider can get past Layer 1 security in this scenario, decrypting the stream’s going to be a cakewalk.)