Topics in this domain
- Security Governance and Roles
- Data Classification and Ownership
- Security Policies
- Privacy Principles and GDPR
- Identity Management
- Authentication Factors
- Biometrics
- Access Models: DAC, MAC, RBAC
- Logical and Privileged Access
- Cryptography Basics
- Symmetric Encryption
- Asymmetric Encryption
- Hashing and Integrity
- Digital Signatures
- PKI and Certificates
- Firewalls
- IDS/IPS
- VPN, SSL/TLS, IPsec
- Wireless Security
- Endpoint and Mobile (BYOD)
- Cloud and Virtualization Security
- Physical Access Controls
- Environmental Controls: Fire, Power, HVAC
- Social Engineering
- Malware
- Network Attacks: DoS, Spoofing, Sniffing
- Application Attacks: SQLi, XSS
- Vulnerability Management and Pen Testing
- Incident Response
- Digital Forensics and Chain of Custody
- Security Awareness Training
- Logging, SIEM, and Auditing Security
VPN, SSL/TLS, IPsec
A private tunnel on a public road
Imagine driving through a busy city in a sealed, armoured lorry. Everyone can see the lorry, but nobody can see or touch what’s inside.
A virtual private network (VPN) does that for data crossing an untrusted network such as the internet: it builds an encrypted tunnel.
- Site-to-site VPNs join offices or data centres, usually with IPsec between gateways.
- Remote-access VPNs connect individual users, with IPsec or TLS-based clients.
IPsec
IPsec secures traffic at the network layer, so it protects every application without any changes to them.
| Part | Role |
|---|---|
| Authentication Header (AH) | Integrity, and proof of where the packet came from. No encryption |
| Encapsulating Security Payload (ESP) | Encryption for confidentiality, with optional integrity and authentication |
| Internet Key Exchange (IKE) | Negotiates the settings and exchanges keys |
| Security association (SA) | The agreed algorithms, keys and parameters for a connection |
Modes
- Transport mode protects only the payload; the original IP header stays visible. Usually host to host.
- Tunnel mode encrypts the entire original packet and wraps it in a new IP header, hiding internal addresses. Usually gateway to gateway. Think of putting the whole letter, envelope and all, inside a new envelope.
TLS
Transport Layer Security (the successor to SSL) secures application traffic: HTTPS, email between servers, and most APIs.
- Client and server agree a version and a set of algorithms (cipher suite).
- The server presents its certificate, which the client checks against trusted CAs.
- A session key is agreed, usually with ephemeral Diffie-Hellman, which gives forward secrecy (stealing the server’s key later doesn’t unlock old sessions).
- Data is protected with fast symmetric encryption and integrity checks.
TLS provides confidentiality, integrity and server authentication (and client authentication too, if client certificates are used).
Configuration issues: SSL 2/3 and TLS 1.0/1.1 are deprecated; weak cipher suites should be switched off; certificates must be valid and trusted. Training users to click through certificate warnings throws away TLS’s server authentication.
Other secure protocols: SSH for remote administration and file transfer (SFTP), S/MIME and PGP for email, and HTTPS, which is simply HTTP over TLS.
Remote access weaknesses
- Password-only VPN: require MFA.
- Split tunnelling: the device talks to the internet and the corporate network at the same time, so a compromised laptop can bridge the two. Disable it, or apply strong endpoint controls.
- Unmanaged devices: check device health (posture) before granting access.
- Unpatched VPN appliances: a favourite target for attackers.
- Broad access once connected: segment the network and apply least privilege, or move towards zero-trust access.
Encryption in transit doesn’t protect data once it’s stored on either end.
Example. Attackers use a known flaw in an unpatched VPN appliance to steal session tokens and log in without passwords. The organisation had MFA, but the appliance hadn’t been patched for eight months. The finding is about patch management of perimeter devices.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| IPsec protocol that provides confidentiality | ESP |
| IPsec protocol providing integrity without encryption | AH |
| Mode encrypting the entire packet | Tunnel mode |
| What TLS uses to authenticate the server | The server’s certificate |
| Risk of split tunnelling | Compromised device bridges internet and corporate network |
| Best control for remote access | MFA plus patched, monitored VPN infrastructure |
In short
- A VPN creates an encrypted tunnel over an untrusted network; site-to-site VPNs connect networks, remote-access VPNs connect users.
- IPsec works at the network layer: AH provides integrity and authentication; ESP provides confidentiality (encryption) plus optional integrity.
- IPsec transport mode encrypts only the payload; tunnel mode encrypts the entire original packet and adds a new header.
- IKE negotiates IPsec security associations and keys.
- TLS (successor to SSL) secures application traffic such as HTTPS, using certificates for server authentication and symmetric session keys for data.
- SSL and early TLS versions are deprecated; use TLS 1.2 or 1.3 with strong cipher suites.
- Split tunnelling lets remote users reach the internet directly while connected, which can expose the corporate network.
Exam traps
- AH doesn't encrypt; ESP does.
- Tunnel mode hides the original IP header; transport mode doesn't.
- An expired or self-signed certificate that users click through defeats TLS's server authentication.
- VPN access with only a password is a common finding; require MFA.
- Encryption in transit doesn't protect data at rest on either end.
Slides
Click the slide and use the arrow keys. F toggles full screen.
IPsec's parts
IPsec modes
How TLS works
Remote access weaknesses