Non-repudiation
Proof that the sender actually sent the data; the sender
cannot later deny having sent it. Non-repudiation is usually
a side-effect of authentication.
VPNs are normally only concerned with confidentiality and authentication. Non-repudiation is
normally not handled at the network level but rather is usually done at a higher, transaction
level.
9.1.3. VPN Planning
An attacker targeting a VPN connection will typically not attempt to crack the VPN encryption
since this requires enormous effort. They will, instead, see VPN traffic as an indication that there
is something worth targeting at the other end of the connection. Typically, mobile clients and
branch offices are far more attractive targets than the main corporate network. Once inside
those, getting to the corporate network then becomes easier.
In designing a VPN there are many issues that need to be addressed which aren't always obvious.
These include:
•
Protecting mobile and home computers.
•
Restricting access through the VPN to needed services only, since mobile computers are
vulnerable.
•
Creating DMZs for services that need to be shared with other companies through VPNs.
•
Adapting VPN access policies for different groups of users.
•
Creating key distribution policies.
Endpoint Security
A common misconception is that VPN-connections are equivalents to the internal network from
a security standpoint and that they can be connected directly to it with no further precautions. It
is important to remember that although the VPN-connection itself may be secure, the total level
of security is only as high as the security of the tunnel endpoints.
It is becoming increasingly common for users on the move to connect directly to their company's
network via VPN from their laptops or tablets. However, the client equipment itself is often not
protected. In other words, an intruder can gain access to the protected network through an
unprotected laptop and already-opened VPN connections.
Placement in a DMZ
A VPN connection should never be regarded as an integral part of a protected network. The VPN
firewall should instead be located in a special DMZ or outside a firewall dedicated to this task. By
doing this, the administrator can restrict which services can be accessed via the VPN and ensure
that these services are well protected against intruders.
In instances where the firewall features an integrated VPN feature, it is usually possible to dictate
the types of communication permitted and NetDefendOS VPN has this feature.
9.1.4. Key Distribution
Key distribution schemes are best planned in advance. Issues that need to be addressed include:
Chapter 9: VPN
669
Содержание NetDefendOS
Страница 30: ...Figure 1 3 Packet Flow Schematic Part III Chapter 1 NetDefendOS Overview 30 ...
Страница 32: ...Chapter 1 NetDefendOS Overview 32 ...
Страница 144: ...Chapter 2 Management and Maintenance 144 ...
Страница 220: ... Enable DHCP passthrough Enable L2 passthrough for non IP protocols 4 Click OK Chapter 3 Fundamentals 220 ...
Страница 267: ... SourceNetwork lannet DestinationInterface any DestinationNetwork all nets 4 Click OK Chapter 3 Fundamentals 267 ...
Страница 284: ...Chapter 3 Fundamentals 284 ...
Страница 360: ...The ospf command options are fully described in the separate NetDefendOS CLI Reference Guide Chapter 4 Routing 360 ...
Страница 392: ...Chapter 4 Routing 392 ...
Страница 396: ...Web Interface 1 Go to Network Ethernet If1 2 Select Enable DHCP 3 Click OK Chapter 5 DHCP Services 396 ...
Страница 419: ... Host 2001 DB8 1 MAC 00 90 12 13 14 15 5 Click OK Chapter 5 DHCP Services 419 ...
Страница 420: ...Chapter 5 DHCP Services 420 ...
Страница 424: ...2 Now enter Name lan_Access Action Expect Interface lan Network lannet 3 Click OK Chapter 6 Security Mechanisms 424 ...
Страница 573: ...Chapter 6 Security Mechanisms 573 ...
Страница 575: ...This section describes and provides examples of configuring NAT and SAT rules Chapter 7 Address Translation 575 ...
Страница 607: ...Chapter 7 Address Translation 607 ...
Страница 666: ...Chapter 8 User Authentication 666 ...
Страница 775: ...Chapter 9 VPN 775 ...
Страница 819: ...Chapter 10 Traffic Management 819 ...
Страница 842: ...Chapter 11 High Availability 842 ...
Страница 866: ...Default Enabled Chapter 13 Advanced Settings 866 ...
Страница 879: ...Chapter 13 Advanced Settings 879 ...