Next, consider the confidentiality controls in place. How are the two servers connecting to each other? Are they using SSL or another secure, encrypted protocol? If the servers are using a secure protocol, a VPN connection may add unnecessary overhead to the communication, as each message would be encrypted and decrypted twice. In that case, skip the VPN. On the other hand, if you're not confident in the security of the encryption used by the client/server protocol, an IPsec VPN configured to use strong encryption is a safe, reliable choice.
- A SearchSecurity.com reader asks whether Trojans and other malware can exploit split-tunnel VPNs.
- Expert Michael Cobb addresses the difference between Triple DES and DUKPT encryption for financial transactions.
This was first published in June 2008