7
IPsec VPN
115
VPN encryption
Encryption
of
VPN
traffic
is
done
using
the
science
of
cryptography
.
Cryptography
is
an
umbrella
expression
covering
3
techniques
and
benefits:
Confidentiality
No
one
but
the
intended
recipients
is
able
to
receive
and
understand
the
communication.
Confidentiality
is
accomplished
by
encryption.
Authentication
and
integrity
Proof
for
the
recipient
that
the
communication
was
actually
sent
by
the
expected
sender,
and
that
the
data
has
not
been
modified
in
transit.
This
is
accomplished
by
authentication,
and
is
often
implemented
through
the
use
of
cryptographic
keyed
hashing.
Non
‐
repudiation
Proof
that
the
sender
actually
sent
the
data;
the
sender
cannot
later
deny
having
sent
it.
Non
‐
repudiation
is
usually
a
side
‐
effect
of
authentication.
VPNs
are
typically
concerned
only
with
confidentiality
and
authentication.
Non
‐
repudiation
is
normally
not
handled
at
the
network
level
but
rather
is
usually
done
at
a
higher
transaction
level.
VPN planning
An
attacker
targeting
a
VPN
connection
typically
views
VPN
traffic
as
an
indication
that
there
is
something
worth
targeting
at
the
other
end
of
the
connection.
In
most
cases,
mobile
clients
and
branch
offices
are
far
more
attractive
targets
than
the
main
corporate
network.
Once
inside
those,
getting
to
the
corporate
network
then
becomes
easier.
In
designing
a
VPN
there
are
many
issues
that
need
to
be
addressed
that
aren't
always
obvious.
These
include:
•
Protecting
mobile
and
home
computers.
•
Restricting
access
through
the
VPN
to
needed
services
only,
since
mobile
computers
are
vulnerable.
•
Creating
DMZs
for
services
that
need
to
be
shared
with
other
companies
through
VPNs.
•
Adapting
VPN
access
policies
for
different
groups
of
users.
•
Creating
key
distribution
policies.
Endpoint security
A
common
misconception
is
that
VPN
‐
connections
are
equivalents
to
the
internal
network
from
a
security
standpoint
and
that
they
can
be
connected
directly
to
it
with
no
further
precautions.
It
is
important
to
remember
that
although
the
VPN
connection
itself
may
be
secure,
the
total
level
of
security
is
only
as
high
as
the
security
of
the
tunnel
endpoints.
