Title: Protecting Remote Connections
Course: IN 2001 Principle of Information Assurance > Section: Module 6: Chapter Six

Protecting Remote Connections
1. Installing Internetwork connections requires using leased lines or other data channels provided by common carriers and therefore these connections are usually permanent and secured under the requirements of a formal service agreement.
2. In the past, organizations provided remote connections exclusively through dial-up services like Remote Authentication Service (RAS). Since the Internet has become more widespread in recent years, other options, such as Virtual Private Networks (VPNs), have become more popular.

Remote Access
1. It is a widely held view that these unsecured, dial-up connection points represent a substantial exposure to attack.
2. An attacker who suspects that an organization has dial-up lines can use a device called a war dialer to locate the connection points.
3. A war dialer is an automatic phone-dialing program that dials every number in a configured range and checks to see if a person, answering machine or modem picks up.
4. Some technologies, such as RADIUS systems, TACACS and CHAP password systems, have improved the authentication process.

RADIUS, TACACS, and Diameter
1. 1.    RADIUS and TACACS are systems that authenticate the credentials of users who are trying to access an organization’s network via a dial-up connection.
2. Remote Authentication Dial-In User Service system places the responsibility for authenticating each user in the central RADIUS server.
3. When a remote access server receives a request for a network connection from a dial-up client, it passes the request along with the user’s credentials to the RADIUS server, which then validates the credentials and passes the resulting decision (accept or deny) back to the accepting RAS.
4. The Diameter protocol defines the minimum requirements for a system that provides Authentication, Authorization and Accounting (AAA) services and can go beyond these basics and add commands and/or object attributes.
5. Diameter security uses existing encryption standards including IPSEC or TLS, and its cryptographic capabilities are extensible and will be able to use future encryption protocols as they are implemented.
6. Similar in function to the RADIUS system is the Terminal Access Controller Access Control System (TACACS).
7. Like RADIUS, it is a centralized database and it validates the user’s credentials at the TACACS server.

Securing Authentication with Kerberos
1. Kerberos uses symmetric key encryption to validate an individual user to various network resources.
2. Kerberos keeps a database containing the private keys of clients and servers.
3. In the case of a client, this key is simply the client’s encrypted password.
4. The Kerberos system knows these private keys and can authenticate one network node (client or server) to another. Kerberos consists of the following interacting services, all of which use a database library:
  - Authentication server (AS), which is a Kerberos server that authenticates clients and servers
  - Key Distribution Center (KDC), which generates and issues session keys
  - Kerberos ticket granting service (TGS), which provides tickets to clients who request services
5. In Kerberos, a ticket is an identification card for a particular client that verifies to the server that the client is requesting services and that the client is a valid member of the Kerberos system and is, therefore, authorized to receive services.
6. The ticket consists of the client’s name and network address, a ticket validation starting and ending time, and the session key, all of which are encrypted in the private key of the server from which the client is requesting services.

Sesame
1. The Secure European System for Applications in a Multivendor Environment (SESAME) is similar to Kerberos in that the user is first authenticated to an authentication server and receives a token.
2. The token is then presented to a privilege attribute server (instead of a ticket granting service as in Kerberos) as proof of identity to gain a privilege attribute certificate (PAC).
3. SESAME also builds on the Kerberos model by adding additional and more sophisticated access control features more scalable encryption systems, as well as improved manageability, auditing features and the delegation of responsibility for allowing access.

Virtual Private Networks (VPNs)
1. A VPN is a private and secure network connection between systems that uses the data communication capability of an unsecured and public network. VPNs are commonly used to extend securely an organization’s internal network connections to remote locations beyond the trusted network.
2. The VPNC defines three VPN technologies:
  - A trusted VPN, or legacy VPN, uses leased circuits from a service provider and conducts packet fetching over these leased circuits
  - A secure VPN uses security protocols and encrypts traffic transmitted across unsecured public networks like the Internet
  - A hybrid VPN combines the two, providing encrypted transmissions (as in secure VPN) over some or all of a trusted VPN network
3. A VPN that proposes to offer a secure and reliable capability while relying on public networks must address:
  - Encapsulation of incoming and outgoing data, wherein the native protocol of the client is embedded within the frames of a protocol that can be routed over the public network as well as be usable by the server network environment
  - Encryption of incoming and outgoing data to keep the data contents private while in transit over the public network, but usable by the client and server computers and/or the local networks on both ends of the VPN connection
  - Authentication of the remote computer and, perhaps, the remote user.  Authentication and the subsequent authorization of the user to perform specific actions are predicated on accurate and reliable identification of the remote system and/or user

Transport Mode
1. In transport mode, the data within an IP packet is encrypted, but the header information is not.
2. This allows the user to establish a secure link directly with the remote host, encrypting only the data contents of the packet.
3. There are two popular uses for transport mode VPNs:
  - The end-to-end transport of encrypted data.  In this model, two end users can communicate directly, encrypting and decrypting their communications as needed.  Each machine acts as the end node VPN server and client
  - A remote access worker or teleworker connects to an office network over the Internet by connecting to a VPN server on the perimeter

Tunnel Mode
1. In tunnel mode, the organization establishes two perimeter tunnel servers.  These servers serve as the encryption points, encrypting all traffic that will traverse an unsecured network.
2. In tunnel mode, the entire client packet is encrypted and added as the data portion of a packet that is addressed from one tunneling server and to another.  The receiving server decrypts the packet and sends it to the final address.
3. The primary benefit to this model is that an intercepted packet reveals nothing about the true destination system.