AH Authentication Header VPN Protocols

35 HMAC-SHA and HMAC-MD5 HMAC is a symmetric authentication system supported by these two hashes.

2.3.4 Internet Key Exchange, ISAMKPOakley

In the parlance of the IPSec working documents produced by the IETF, a Security Association is any protected conversation between two possibly hostile parties. Having only ESP and AH does not complete the picture for an IPSec system. For secure communication, both parties must be able to negotiate keys for use while the communication is happening. Plus, both parties need to be able to decide which encryption and authentication algorithms to use. The Internet Key Exchange IKE protocol formerly known as ISAKMPOakley provides authentication of all peers, handles the security policies each can perform, and controls the exchange of keys. Key generation and key rotation are important because the longer the life of the key, the larger the amount of data at risk, and the easier it becomes to intercept more ciphertext for analysis. This is the concept of perfect forward secrecy. By changing the keys often, it becomes difficult for a network snoop to get the big picture if they have to keep cracking keys. Further, the keys generated on the fly should not bear any resemblance to one another, and should not be generated from environmental variables that could easily be guessed time of day, server load, etc. IKE uses the Diffie-Hellman key exchange protocol to handle this, and has proven to be adequate in its protection.

2.3.5 ISO X.509 v.3 Digital Certificates

Although not a security protocol in the same fashion as ESP and AH, the X.509 system is important because it provides a level of access control with a larger scope. Because the X.509 certificate systems are used with other Public Key Infrastructure devices and software, IPSec vendors have chosen to incorporate them into their equipment to handle authentication. Certificate management, as handled by a trusted third party, will play a big role in the future of the IPSec suite, and work is already being done by vendors to have their products communicate with the public CAs Certificate Authorities for authentication.

2.3.6 LDAP Lightweight Directory Access Protocol

Closely related to the X.509 system is the Lightweight Directory Access Protocol, or LDAP. LDAP is a smaller, and logically easier to implement, X.500 service that is supported on various VPN solutions to provide authentication and certificate management. Hardware products like the Bay Networks Extranet Switch use LDAP as well as some popular software solutions, such as Windows NT and Novell. It is becoming more common to use trusted third- party authentication systems such as LDAP and the X.500 directory system for remote access to a corporate network or a VPN.

2.3.7 Radius

Where LDAP and the X.500 systems provide authentication and certificate management to users anywhere in the world, Radius is an authentication system used more for intra- organization lookups. The Radius system was developed as an open standard by Livingstone Enterprises, and is not currently sanctioned by the IETF, but is under consideration. Recently, Merit updated the Radius system to enhance its clientserver capabilities and its vendor 36 specific attributes, allowing manufacturers to tailor their products and services to specific markets. More VPN solutions currently support authentication using Radius than the other public certificate systems mentioned above, but a groundswell of support for the X.500 system is well underway.

2.3.8 PPTP Point-to-Point Tunneling Protocol

The Point-to-Point Tunneling Protocol PPTP is an extension of the standard PPP Point-to- Point Protocol. The tunneling services provided by PPTP are intended to ride on top of the IP layer, whereas the traditional PPP protocol underlies IP. PPP was ideally suited for modification because its functionality already mimics the behavior of what a VPN would need: a point-to-point tunnel. All that was missing was the security. PPTP, however, is more of a host-to-host secure communications channel, rather than a LAN-to-LAN one. Although it is quite possible to route traffic across a PPTP tunnel, the IPSec solutions are better geared for this type of application.

2.4 Methodologies for Compromising VPNs

In this section we vicariously take on the role of the people we are trying to thwart: those who want to inspect, intercept, and interfere with the transmission of your data.

2.4.1 Basic Firewalling

Services that you will likely offer to the Internet include mail such as the POP, SMTP, and IMAP protocols, World Wide Web HTTP and HTTPS protocols, and a host of other things including DNS, FTP, video or audio streaming, and network time. Our discussion of services plays directly into the first section, where we begin to explore one of the introductory yet powerful ways for protecting data firewalls. Although they are not tangible like data files that contain customer credit card numbers, services that you choose to offer your customers on the Internet play a huge role in defining the form the firewall takes and what types of data you think will assist the customer. Before even embarking on the creation of the firewall, you need to develop an overall data strategy. What do customers have access to? What do normal employees have access to? What can advanced security folks see and do? Once you have spent some time in detailing the blueprint for your network, you can begin to create the doors and windows that permit visitors. Some popular services are sometimes dangerous to run, and come with security dilemmas that we can never seem to shake, but are so important that we would argue against removing them. The application that receives the most attention by security professionals is sendmail. The reasons for this are simple: the source code for the most popular implementation of sendmail the Berkeley Version 8 software is readily available and the running daemon is easily located on someones network. Because of this, pay careful attention to the sendmail servers that are available to the public and how they are configured. Our ultimate goal in setting up security barriers is to make a break-in too time- consuming, too difficult to complete, and once completed, too unrewarding to make it worth a crackers time and effort. If you look like a terrible target, they will go elsewhere and leave you alone. Most computer crimes are much like everyday real crimes—they are crimes of convenience that could be avoided by erecting a minimal deterrent.