VPN Security

Enquiry Online & Avail Free Service

VPN Security

With more and more employees working remotely, either from home or on the go, enterprises need a way to secure their communications with the corporate network. One solution is a virtual private network (VPN), which enables employees to securely send data between computers across a shared or public network.

VPNs were developed to solve two challenges: the high cost of leased lines for branch offices, and the growing need to enable remote workers to access the corporate network securely.

While VPNs provide security by encrypting data and sending it through a “tunnel,” there are limitations to that security. Before examining those limitations, let’s take a look at how VPNs work.

How does a VPN work?

A VPN involves the transfer of encrypted data wrapped with a header containing routing information. This process enables the data to travel securely over a shared or public network to reach its endpoint.

Data packets passed over the public network in this way are unreadable without the decryption keys, thus ensuring that data is not disclosed or changed during transmission.

From the user’s perspective, the VPN connection is a point-to-point connection between the user’s computer and a corporate server. The nature of the public network is irrelevant to the user because it appears as if the data is being sent over a dedicated private link.

As workers become more mobile, VPN connections allow users working at home or on the road to connect in a secure fashion to a remote corporate server using the routing infrastructure provided by a public network, such as the Internet.

VPNs improve Wi-Fi security

Many of these mobile workers use public Wi-Fi to access corporate data, and more than one-third never use a VPN to protect their data even though two-thirds are concerned about public Wi-Fi security, according to a survey by iPass. VPN remains a viable option for securing data transferred over public Wi-Fi.

Of course, it is not just employees working remotely who could endanger the security of corporate data and networks. Third parties, such as vendors, contractors and suppliers, could pose risks by accessing corporate resources in an insecure manner. A VPN is just one way to reduce security risks from third parties.

In the enterprise, VPNs are used in number of ways, including remote access for users connecting to the corporate network from home or a mobile device, intranet connections among fixed locations such as branch offices, extranet connections with business partners such as suppliers and customers, and wide area network (WAN) replacement for geographically dispersed networks.

As a WAN replacement, VPN can be cheaper because it requires less overhead to maintain and offers better scalability. However, network reliability and performance might become an issue, especially when connections are tunneled through the Internet.

Types of VPNs There are basically four types of VPNs:

  • A firewall-based VPN is equipped with both a firewall and VPN capabilities. This type uses the security provided by firewalls to restrict access to an internal network and provides address translation, user authentication, alarms and logging.
  • A hardware-based VPN provides high network throughput as well as improved performance and reliability, but is also expensive.
  • A software-based VPN provides flexibility in terms of how traffic is managed. This is best for when endpoints are not controlled by the same party and when different firewalls and routers are used.
  • A secure socket layer (SSL) VPN enables users to connect to VPN devices using a web browser. SSL is used to encrypt traffic between the web browser and the VPN device.

VPN risks – and must-have security features

Are VPNs safe, you may ask? Admittedly, there are security risks associated with VPNs. These include VPN hijacking, in which an unauthorized user takes over a VPN connection from a remote client, man-in-the-middle attacks, in which the attacker is able to intercept data, weak user authentication, split tunneling, in which a user is accessing an insecure Internet connection while  also accessing the VPN connection to a private network, malware infection of a client machine, granting too many network access rights, and DNS leak in which the computer uses its default DNS connection rather than the VPN’s secure DNS server.

To address these risks, enterprises should consider additional VPN security features when choosing a VPN product. These include must-have security features include:

  • support for strong authentication
  • strong encryption algorithms
  • support for anti-virus software and intrusion detection and prevention tools
  • strong default security for administration and maintenance ports
  • digital certificate support
  • logging and auditing support
  • and the ability to assign addresses to clients on a private network while ensuring all addresses are kept private.

Also, having a kill switch is an important VPN security precaution. The kill switch ensures that if the computer loses the VPN connection, either the Internet connection is shut down or the apps that are using the connection are shut down. This prevents the Internet address from being exposed.

In addition, training should be conducted for network and security administrators and support staff, as well as remote users, to ensure that they follow security best practices during VPN implementation and ongoing use.

Another way to improve VPN security is through perfect forward secrecy (PFS). If PFS is used, encrypted communications and sessions recorded in the past cannot be retrieved and decrypted should long-term secret keys or passwords be compromised.

With PFS, each VPN session uses a different encryption key combination, so even if attackers steal one key, they will not be able to decrypt any other VPN sessions.

VPN tunneling protocols

VPN tunneling protocols offer different features and levels of security, and there are benefits and disadvantages to each. There are five main VPN tunneling protocols: Secure Socket Tunneling Protocol (SSTP), Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), OpenVPN, and Internet Key Exchange version 2 (IKEv2).

SSTP uses the HTTPS protocol to pass traffic through firewalls and web proxies that might block other protocols. SSTP provides a mechanism to wrap point-to-point protocol (PPP) traffic over the SSL channel. The use of PPP allows support for strong authentication methods, and SSL provides transport-level security with enhanced key negotiation, encryption and integrity checking.

PPTP allows multiprotocol traffic to be encrypted and then wrapped in a header to be sent across an Internet protocol (IP) network. PPTP can be used for remote access and site-to-site VPN connections. When using the Internet, the PPTP server is a PPTP-enabled VPN server with one interface on the Internet and a second interface on the corporate intranet. PPTP uses a transmission control protocol connection for tunnel management and generic routing encapsulation to wrap PPP frames for tunneled data.

L2TP enables multiprotocol traffic to be encrypted and then sent over any medium that supports PPP data delivery, such as IP or asynchronous transfer mode. L2TP is a combination of PPTP and Layer 2 Forwarding (L2F). L2TP represents the best features of PPTP and L2F. Unlike PPTP, L2TP relies on IP Security (IPsec) in transport mode for encryption services. The combination of L2TP and IPsec is known as L2TP/IPsec. Both L2TP and IPsec must be supported by both the VPN client and the VPN server. L2TP/IPsec is perfect forward secrecy capable.

OpenVPN is an open-source software application that implements VPN techniques for creating secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. It uses a custom security protocol that uses SSL/TLS for key exchange. It is capable of traversing network address translators and firewalls. OpenVPN allows peers to authenticate each other using a secret key, certificate, or username and password. Most VPN providers using OpenVPN employ perfect forward secrecy.

IKEv2 is an IPSec-based protocol that is baked into Windows 7 and above. IKEv2 is the next-generation standard for secure key exchange between peer VPN devices. IKEv2 is particularly good at automatically re-establishing a VPN connection when users temporarily lose their Internet connections.

Choosing the most secure VPN for your organization

So how do you choose the most secure VPN? Even though it is open source-based, many view OpenVPN as the most secure VPN protocol. It is stable and reliable, easily configured to run on any port, supports hardware acceleration for improved speeds, is able to traverse firewalls and network address translation (NAT), and uses OpenSSL libraries for encryption. However, it requires client software and cannot be used on iPhones and only on a limited number of Android phones.

Another secure VPN protocol is L2TP/IPSec. It has strong encryption, no additional software for devices, is built into most desktop operating systems and mobile devices, is fairly easy to implement, and has no known major vulnerabilities. However, it does have trouble with firewalls, it is challenging to configure on a Linux server, and it is relatively easy to block by Internet service providers.

SSTP provides strong encryption, is very hard to detect and block, and is supported on all Microsoft Windows computers. At the same time, it is not supported by all VPN providers, and there is limited support for non-Windows devices.

The least secure VPN protocol is PPTP. Its benefits include easy setup, wide support for most devices, and low overhead. Because it has been around for a long time, it has known security issues that could be exploited by hackers (or government agencies). It has weak encryption and is relatively easy to block by ISPs.

IKEv2 is supported as part of IPSec implementation in Windows, easy to use, shorter negotiation period, and essential features standard. However, the bugs are still being worked out, and interoperability between different vendors is an issue.

Which VPN protocol is best depends on the enterprise and the individual. For those looking for the most secure, OpenVPN is the best. For those looking for support for many devices, PPTP may be the way to go.

A VPN provides a means of accessing a secure corporate network over insecure public networks. While a VPN is an improvement over transmitting unencrypted data over public networks, the potential security flaws should be considered by enterprises considering deploying a VPN or those that have already deployed one. Choosing the most appropriate VPN is vital for improved security in the enterprise.

About Us

The 18-year history of L A Technologies Pvt.Ltd is one that speaks of the evolution of a company by a visionary, Mr. Lawrence Albert, and of its employees, who have helped businesses and governments apply information technology to achieve new levels of competitiveness and success.

Main Menu

Branch

  • 101 B, Pinnacle Corporate Park,
    B Wing, First Floor, CTS 4207 Part,
    Bandra Karla Complex ,
    Bandra (East), Mumbai 400051
  • sales@la-technologiesindia.com
  • +91 22 61828400

© Copyrights 2010. All rights reserved. by / L A Technologiesindia.com

Facebook-f Twitter Google-plus-g Linkedin-in Skype