Security Management Strategies for the CIOWe use two methods for connecting two remote servers through the Internet: either an IPsec VPN or by opening the port of the remote server. The two servers are mainly used for financial transactions. What are the risks involved with using each method, and which do you recommend?
Requires Free Membership to View
First, I'm assuming that there are both network and client firewalls between the servers on both ends of the connection. If this is not the case, definitely revisit the network topology to determine if this type of basic Internet shielding can be implemented. In the case you describe, the firewall protecting the server should be configured to allow traffic only on that single required port from the single IP address of the remote server.
Next, consider the confidentiality controls in place. How are the two servers connecting to each other? Are they using SSL or another secure, encrypted protocol? If the servers are using a secure protocol, a VPN connection may add unnecessary overhead to the communication, as each message would be encrypted and decrypted twice. In that case, skip the VPN. On the other hand, if you're not confident in the security of the encryption used by the client/server protocol, an IPsec VPN configured to use strong encryption is a safe, reliable choice.
More information:
- A SearchSecurity.com reader asks whether Trojans and other malware can exploit split-tunnel VPNs.
- Expert Michael Cobb addresses the difference between Triple DES and DUKPT encryption for financial transactions.
This was first published in June 2008
Join the conversationComment
Share
Comments
Results
Contribute to the conversation