VIRTUAL PRIVATE NETWORKS

CH 12 InfoSec Handbook

Securing Networks

For past few weeks, we’ve explored Network Attacks & mechanisms which can protect our Networks

• FWs + DMZs + IDS/IPS

​

But how do we protect our data while traversing WAN?

​

Securing Networks (cont.)

2 main ways for org’s to connect their networks with outside partners/vendors and internal but remote staff:

• Dedicated Leased Lines
• Shared network bandwidth with existing lines

​

Dedicated Leased Lines

Non-shared, physically private WAN connections:

• Tend to get expensive, and not always available as option

​

​

Shared Lines

Non-private (thus public!) WAN connections (i.e. Internet)

​

Q: So how do we ensure our network traffic has C of CIA over publicly shared WAN connections?

​

​

Virtual Private Networks (VPNs)

Creates a “virtual” tunnel connection routed through Internet from company’s trusted network to the remote office/workstation.

• Send data via public network which emulates a private link between the two parties or two networks.

The CIA of VPNs

• VPN encrypts data before passing it through tunnel to ensure Confidentiality of all through sent thru them�
• Data Integrity and Authenticity are also maintained before creation of tunnel.�
• VPN does not impact Availability

​

VPN Advantages

• Cost savings: Cheaper vs. Dedicated Lines + easily scalable.�
• Seamless Integration: Works with existing network infrastructure.�
• Secure Remote Access: Allows same connectivity whether it is network-to-network, host-to-host, client-to-server, or home office/mobile users.�
• Extranet Connections: secured connection between 2 partners, allowing even proprietary information to be shared.�
• Low Maintenance: Eliminates much of the day-to-day key management and Network Management once set.

Your my Type of VPN

Primarily, VPN supports 2 types of communication:

• Remote Access (host-to-site)
• Site-to-site (intranet and extranet)

​

​

Remote Access VPN

Connection between a user and the LAN

• Thus, Host-to-Site

​

• Remote employees, once they connect to Internet, use their VPN client to connect to corporate LAN:
• VPN client first connects to the VPN gateway server which authenticates
• Creates "virtual" tunnel between remote host and gateway
• Channel becomes secured
• Remote host can connect to any allowed resource in trusted LAN

​

Remote Access VPN (cont.)

​

​

​

​

​

​

​

Site-to-Site VPN

Connects one LAN to another LAN over Internet

​

• Tunnel created between two VPN gateways
• Remote hosts will not have any VPN clients, but send normal traffic through VPN gateways
• VPN gateways are responsible for authentication network traffic encryption and integrity
• Once VPN gateway receives encrypted data: it strips headers, decrypts content, then relays unencrypted data toward target host inside trusted LAN

Site-to-Site VPN (cont.)

Types of Site-to-Site VPNs

• Intranet-based
• Creates “single internal LAN” within an org via actual different locations + LANs using VPNs

​

• Extranet-based
• Multiple orgs create additional, but limited network access between themselves to share certain resources + access

​

​

Most orgs use both

VPNs & Firewalls

• Combo of both ensures only authorized apps and users access information

​

• VPN Firewall ensures that malicious intentions are impeded and only authentic traffic enters into VPN

​

• VPN and Firewall can be deployed separately & normally VPN is deployed after FW

​

• First check of entry is firewall: FW provides proper policy & access check, then allows traffic to pass through VPN

VPNs & Firewalls (cont.)

VPN Protocols

VPN supports secured communication over public network:

• Each party should know how they securely communicate, how they encrypt data, and how they exchange decryption keys so that each party can transmit information securely

​

VPN connection has two phases:

• 1. Both parties establish secured connection by identifying themselves as genuine parties & exchanging keys to support data encryption/decryption, & data integrity
• 2. Data transfer happens with encrypted data, where only two parties know the keys

VPN Protocols (cont.)

For secured connection, VPN protocols should support:

​

• Tunneling
• Data Authentication
• Data Integrity
• Data Encryption
• Anti-replay services

Tunneling

• Encapsulation of one type of data packet within another data packet
• A specific packet of one protocol is wrapped into another protocol, and then transmitted between a VPN client and VPN server

​

• Example: IP packet is wrapped around PPTP (VPN protocol) & transmitted 🡪 PPTP is tunneling VPN protocol�
• PPTP protocol itself manages user authentication, data integrity, and data encryption/decryption

​

​

Data Authentication & Integrity

Data authentication guarantees authenticity of two parties communicating with each other

​

• It authenticates that data is actually being received from genuine/legit user who has sent the data

​

• Integrity means that data received has not been modified during transmission (Data in transit)

​

Anti-Replay Services

Services in which receiver device can reject duplicate packets or late arrival packets in order to protect against replay attacks

​

​

​

Network Data Encryption

Implementation of VPN is based upon one of the following protocols:

Acthung! 🡪 This gets into some tech weeds, so best take notes …

Point-to-Point Protocol (PPP)

• Designed for simple links which transport packets between two point-to-point links

​

• These links provide full-duplex simultaneous bi-directional operation, and delivered in order

​

• It is intended to provide a common solution for easy connection of a wide variety of hosts, bridges and routers

​

• Learn from the source 🡪 https://tools.ietf.org/html/rfc1661

​

Point-to-Point Protocol (cont.)

• Layer 2 & initially designed for ISP to service dial-in lines�
• Had to assign addresses between endpoints (home & ISP), as well as ensure Internet service was being given to paying user by authenticating them (PAP or CHAP)

​

• How do we get PPP across various ISP networks using TCP/IP?

​

​

First, there was PPTP

Point-to-Point Tunneling Protocol 🡪 RFC 2637

​

PPTP allows PPP to be tunneled through IP network & provided flow & congestion control & encryption for PPP packets

RIP PPTP

• Quick summary: Microsoft makes its own version of PPTP which naturally became most popular version

​

• Over the years, MS’s PPTP exposed numerous vulnerabilities within its authentication & encryption algorithms …

​

• Ergo, there be dragons there & please do not use it!

​

• Nice run down of it’s demise 🡪 http://www.h-online.com/security/features/A-death-blow-for-PPTP-1716768.html

Replacement: L2TP

Layer Two Tunneling Protocol (L2TP) is extension of PPP

​

Tunnels most any Layer 2 (L2) traffic across IP networks

​

L2TP connection made up of 2 items: tunnel & session

• Tunnel provides reliable transport between 2 L2TP endpoints, and carries only control packets (manages the session)
• Session carries data

​

While L2TP tunnels & connects, it does not authenticate nor encrypt data … #RutRoh

Need some Crypto, STAT!

L2TP is paired up with Internet Protocol Security (IPSec)

• Guess what OSI layer IPSec runs on?

​

• Main functions: Authentication, Encryption and Key Management

​

• Technically, IPSec is a protocol suite (read: bunch of protocols packaged together)

​

• Thus, this often gets a bit messy & often trips up Pro’s, so we will focus on “the fundamentals” …

​

​

IPSec 101

There are 2 main security protocols:

• Authentication Header (AH)
• Encapsulating Security Protocol (ESP)

​

​

There are 2 main modes:

• Tunnel Mode
• Transport Mode (host to host)

IPSec (cont.)

Authentication Header (AH): supports data integrity, authentication, and optional anti-replay services

• Uses Hashed Message Authentication Code (HMAC) for hashes

​

Encapsulation Security Payload (ESP): provides data confidentiality (encryption)

​

Together, AH and ESP provide the full set of security features for IP, and these are configured in a data structure called Security Association (SA).

IPSec (cont.)

Security Architecture for IP (RFC 4301)

​

• Security Protocols – Authentication Header (AH) and Encapsulating Security Payload (ESP)�
• Security Associations – what they are and how they work, how they are managed, and associated processing�
• Key Management – manual and automated via The Internet Key Exchange (IKE)�
• Cryptographic algorithms for authentication and encryption

​

IPSec - Authentication Header (AH)

• Provides authentication of the origin and integrity of the datagram transported between two systems using�
• Uses special hashing algorithm and unique key known only to sender and receiver�
• This key is exchanged during the initial phase of connection establishment and Security Association (SA) is established between the two devices to know how to perform the computation of the algorithm using unique key that has been exchanged during the initial phase, which none of the other systems can perform

IPSec - AH

In Transport Mode – Source IP not modified, & AH added after original IP header

​

In Tunnel Mode – New IPv4 header encapsulated in original IPv4 packet

IPSec - Encapsulation Security Protocol (ESP)

• Maybe used alone or with AH

​

• Encryption algorithms are specified by the SA during negotiation phase

​

• ESP is designed for use with symmetric encryption algorithms: DES, 3DES, RC5, RC4, & AES

​

• ESP uses a shared key for encrypting and decrypting data, which is exchanged between the two parties

​

IPSec- ESP

In Transport Mode – IP payload is encrypted and the original headers are left intact�

In Tunnel Mode –, Entire original IP datagram is encrypted. However, new IP header is not included in the auth mechanism

​

IPSec- Internet Key Exchange (IKE)

• Before secure transmission can begin, both sender and receiver need to negotiate on keys, which are defined in Security Association (SA)

​

• AH is used for authentication and integrity, & ESP is used for privacy 🡪 Both parties exchange "secret" keys

​

• Exchange of keys happens through protocol called Internet Key Exchange (IKE) 🡪 RFC2409

​

• Summary: IKE uses Asymmetric Keys to establish secure connection, which then exchanges shared Symmetric Key for IPSec

​

Asymmetric Keys to get Symmetric Keys?

Asymmetric Keys to get Symmetric Keys?

Final Thoughts re: VPN

• Most mid- to large-sized orgs have VPNs, so need to know them�
• If you remote work, or travel in any capacity … VPNs are a must, so need to use them�
• Like privacy?
• Then VPNs are for you!

​

• FYI: VPNs insides of VPNs are a thing
• Sure, network slows down a bit, but it’s more securer!