IKE enables cryptographic key exchange with encryption and authentication protocol

Chapter 7: Securing Remote and Home Users

Overview Just as a web browser can connect from a home computer to any web server on the planet, so can any network-enabled computer connect to any other type of server over the Internet. This means that home users can technically connect from their home computers directly to servers at work, just as if they were there except slower. In the security-naïve early days of the Internet, many users did just this. Since the Internet is simply a big network, there are no inherent restrictions on any type of use. Users from home could technically have direct access to files on a file server, could print to a network printer at the office, and could connect a database client directly to a database server. But the requirement that the companys information technology assets be secured against hackers also secures them against remote home users. The firewalls that drop hackers connection attempts will also drop remote users attempts to connect to the network. By establishing a VPN, you can both secure the transmission and enforce strong authentication, thus ensuring that remote home users will have access while hackers will not. But VPNs are just the beginning of the real security problem. The Remote Security Problem There are two major problems with allowing legitimate remote users to access your network: • Hackers can easily exploit home computers and use those computers VPN connections to penetrate your network. • Thieves can steal laptops containing VPN software and keys and use them to connect to your network. The next two sections explain these problems in detail. Virtual Private Security Holes Many companies use VPNs to allow authorized users to securely transit firewalls-the practice has become increasingly common in the last two years due to the convenience and efficiency it allows. But this seriously undermines your network security policy. The problem is that hackers can quite easily exploit home computers that have not themselves been secured. And if that home computer has a VPN connection to your network, hackers can relay through the home computer and through the firewall via the virtual private tunnel. Most businesses do not attempt to enforce any sort of security requirements for remote home users, because they dont