Network Security Domain 3: VPNs and IPsec

Network Isolation Part 1

VPNS and IPSec

VPN: Virtual Private Network

​An encrypted (private) connection over the (public) Internet from a device to a network or a network to a network.

• A VPN uses tunneling (via port forwarding or by encapsulating data using one protocol inside of another protocol) to encrypt data at the sending end and decrypt it at the receiving end

• A VPN concentrator (gateway) handles encryption an decryption either as a standalone device (hardware) or as a feature integrated into the firewall (software)

• Protects the data in transit from eavesdropping or other undesirable situations.

Multiple Choice

Tunneling prevents what type of attack?

• Trojan

• Brute Force

• DOS

• eavesdropping

​Remote Access VPN
(Client to Site)

​How it works 

1. A user installs a VPN client software on their device

2. The software authenticates the user and creates an encrypted tunnel to the VPN gateway

3. The gateway acts as the VPN server, allowing the user to access the network

Multiple Choice

Remote Access VPNs require the installation of VPN client software at the remote site and host location.

• True

• False

​Site to Site VPN

​Use case:

Primarily used by businesses with multiple locations to connect their networks and securely share data across different sites, enabling secure data transfer between different network locations and a cost-effective alternative to dedicated private lines.

 
How it works:

VPN gateways at each site encrypt data before sending it over the internet, and the receiving site decrypts it upon arrival, providing seamless and secure access to shared resource.

Multiple Choice

For Site-to-Site VPN to function correctly, the host must have VPN client software installed.

• True

• False

How SSL VPN works:

A user connects to the SSL VPN gateway using a web browser

The VPN gateway presents a secure page for the user to authenticate

If the user authenticates, the SSL VPN creates an encrypted connection between the user's device and the network

The user can then access the network's applications, files, and services

​SSL VPN - uses SSL or TLS encryption to provide authentication and confidentiality at the application layer between the user's browser and the network. (HTTPS)

IPsec VPN- a secure network connection that uses IPsec protocols to encrypt data at the Network layer as it travels over the internet (Popular with Unix, Linux, MacOS, and Windows)

How it works 

Two devices establish a mutual authentication

The devices exchange cryptographic keys

The devices encapsulate data packets, encrypting them and adding an IPsec header

The data is sent over the internet to the VPN server

The VPN server decrypts the data using the correct cryptographic key

Multiple Choice

Uses TLS or its predecessor

Encryption to provide authentication and confidentiality

​Common for HTTPS based websites.

Allows for browser-based VPN connection

• SSL VPN

• IPSec VPN

• Both SSL and IPSec VPNs

• Neither SSL or IPSec VPNs

Provides authentication, integrity and confidentiality through encryption of IP packets. Include anti-replay

​Encapsulating Security Payload (ESP)

Provides data integrity and transport protection services. Designed to be inserted into an IP packet to add authentication data and protect the contents from modification, but does not encrypt the packet.

​Authentication Header (AH)

IPsec Protocols - stands for Internet Protocol Security, is a network security protocol that encrypts data transmitted across IP networks

​Internet Key Exchange (IKE)

Manages the key negotiation process for establishing a secure communication channel (Security Association (SA)) over an untrusted network.

Exchanges encryption keys to create a secure tunnel between a client and a server through which they can send encrypted traffic based on the Diffie-Hellman key exchange.

Multiple Choice

Used for remote logins

​Popular with Unix, Linux, MAC OS, and Windows.

• SSL VPN

• IPSec VPN

Multiple Choice

This IPsec protocol enables 2 systems or devices to establish a secure communication channel over an untrusted network by utilizing a series of key exchanges.

• ESP

• IKE

• AH

• EAS

Multiple Choice

AH (Authentication Headers) use a hash to protect the date contents of communication from modification. This hash supports which pillar of the CIA triad?

• Integrity

• Confidentiality

• Reliability

• Authentication

Multiple Choice

Which IPSec protocol provides authentication, integrity, and confidentiality through encryption of IP packets.

• AH

• ESP

• IKE

• ESPIKAH

Hosts behind one gateway communicate securely with multiple hosts behind the other gateway.

For example, users of systems in a branch office can securely connect with any systems in the main office (i.e. printer server, file server, mail server)

The IPsec tunnel is established between the two gateway hosts, and the entire IP packet including the IP header is encapsulated into a new UP packet. Generally considered more secure

​Tunnel Mode

Two hosts that need to interact with one another (temporarily) set up a directly connected IPsec VPN connection.

For example, to enable a remote IT support technician to log in to a remote server to do maintenance work.

Encrypts only payload (data) of the IP packet, not the header and requires both endpoints of the VPN tunnel to be hosts.

​Transport Mode

IPSec Modes - IPsec has two modes of operation

Multiple Choice

In this mode, two hosts (temporarily) set up a directly connected IPsec VPN connection.

The circuit is usually torn down after the session is complete.

• Tunnel Mode

• Transport mode

• Transit Mode

• Traffic Mode

• Travel Mode

Multiple Choice

Users in a branch office can securely connect with any systems in the main office if the branch office and main office have secure gateways acting as IPsec proxies in this mode.

• Transit Mode

• Transport Mode

• Tunnel Mode

• Travel Mode

• Tube Mode

Multiple Choice

This type of circuit enables multiple hosts behind one gateways to securely access multiple servers behind the another gateway.

• Transport Mode

• Transit Mode

• Traffic Mode

• Tunnel Mode

• Tube Mode

Multiple Choice

This IPSEC mode might be set up to enable a remote IT support technician to log in to a remote server to do maintenance work.

• Transit Mode

• Transport Mode

• Tunnel Mode

• Travel Mode

• Tube mode

Air Gapping

​ isolating a computer or network and preventing it from establishing an external connection.

• An air-gapped computer is physically segregated and incapable of connecting wirelessly or physically with other network devices.

• Air-gapped networks are used to protect many types of critical systems from hackers or other malicious threat actors. (stock market, military, industrial power systems, and government industries)

• Air gaps are also used for backup and recovery. (i.e. Ransomware attack)

Multiple Choice

What is air-gapping?

• Air-gapping is the process of connecting multiple networks together.
• Air-gapping is the practice of physically isolating a computer or network from other networks.
• Air-gapping is a method of increasing internet speed.
• Air-gapping refers to a type of cloud storage.

Multiple Choice

What does a VPN do?

• A VPN speeds up internet connections by creating warp fields.

• A VPN is a type of antivirus software used to protect against antivirus attacks

• A VPN is used to block websites, thereby preventing pharming attacks

• A VPN provides a secure and private connection to the internet.

Multiple Choice

What is one reason you might air-gap a device?

• To improve device performance by connecting to multiple networks.
• To enhance security by isolating it from unsecured networks.
• To allow remote access for easier management.
• To reduce power consumption by disabling network interfaces.

Multiple Choice

What is a real-life situation where air-gapping might be used to enhance security?

• Military networks that handle classified information.
• Home networks for personal use.
• Public Wi-Fi networks in cafes.
• Cloud storage services for data backup.

Exit Slip

You are almost there!

Today, hopefully, you learned about VPN's and IPsec. If you not, you must be living in a tunnel. Get it? VPN? Tunnel? Well, if you paid attention today you would know that was a funny little network security joke. Anyway, answer the following 6 questions to show how well you understood the lesson. Good luck!

Multiple Choice

What is the purpose of a VPN?

• To provide privacy and security for internet users through data encapsulation.

• To enhance internet speed for users through the use of fiber optics

• To provide free internet access worldwide through satellite technology.

• To allow access to local network resources.
• To block all internet traffic completely thus ensuring security.

Multiple Choice

What is IPsec?

• IPsec is a group of hardware devices used for networking.

• IPsec is a suite of programming languages designed to secure websites.

• IPsec is a suite of different types of firewalls used to protect data.

• IPsec is a suite of protocols for securing IP communications.

Multiple Choice

What are the three main IPsec protocols?

• SSL, TLS, and SSH

• L2TP, ARP, and DHCP

• KIA, HA, and SPI

• TSL, AH, and VPNIS

• AH, ESP, and IKE

Multiple Choice

What is one main difference between IPsec Transport mode and IPsec tunnel mode?

• IPsec Transport mode encrypts the entire packet, while IPsec Tunnel mode only encrypts the header.
• IPsec Transport mode encrypts only the payload, while IPsec Tunnel mode encrypts the entire packet.
• IPsec Tunnel mode is used for local area networks, while IPsec Transport mode is for wide area networks.
• IPsec Transport mode is faster than IPsec Tunnel mode because it uses less encryption.

Multiple Choice

What is the main difference between an SSL VPN and an IPsec VPN?

• SSL VPNs are faster than IPsec VPNs.
• IPsec VPNs are only used for remote access, while SSL VPNS are only used for local connections.

• SSL VPNs use SSL/TLS for secure connections, while IPsec VPNs use IPsec protocols.

• SSL VPNs do not provide encryption, while IPsec VPNs provide too much encryption

Multiple Choice

What is one difference between IPsec Transport mode and IPsec Tunnel mode?

• IPsec Transport mode encrypts only the payload, while IPsec Tunnel mode encrypts the entire packet.
• IPsec Transport mode encrypts the entire packet, while IPsec Tunnel mode encrypts only the payload.
• IPsec Transport mode is used for site-to-site connections, while IPsec Tunnel mode is for remote access.
• IPsec Transport mode requires a VPN client, while IPsec Tunnel mode does not require any client.

Multiple Choice

If you were using a site to site VPN which IPsec mode would you most likely use?

• Tunnel mode
• Secure mode
• Enterprise mode

• Traffic mode

• Transport mode

Multiple Choice

Which IPsec protocol provides data integrity and confidentiality through encryption.

• Authentication Header (AH)
• Layer 2 Tunneling Protocol (L2TP)
• Encapsulating Security Payload (ESP)
• Internet Control Message Protocol (ICMP)
• Internet Key Exchange (IKE)

Congratulations!

​You are VPN credible!

Did you get all 5 right? Or at least 4? If you did, give yourself a pat on the back and stunt on your neighbor. If not, turn the VPN in your brain on next lesson a create a secure tunnel to Mr. Carr's lecture.