As more users require remote access to enterprise network systems, software, applications and other resources, the need for reliable and secure virtual private network products continues to grow. With the right VPN, an enterprise can mitigate the security risks inherent to providing remote network access by offering strong encryption to provide data security and strong authentication to limit access to applications based on defined security policies.
One of the most important choices when considering a VPN is whether to opt for an SSL VPN or an IPsec VPN. Enterprises must balance not just the different security risks of each type of network connection encryption, but also weigh the relative advantages relating to network performance, maintenance and configuration when comparing IPsec vs. SSL VPNs.
The major difference between an IPsec VPN and an SSL VPN comes down to the network layers at which encryption and authentication are performed. IPsec operates at the network layer and can be used to encrypt data being sent between any systems that can be identified by IP addresses. SSL -- or, more likely, the Transport Layer Security (TLS) protocol, which replaced the now-deprecated SSL protocol -- operates at the transport layer and is used to encrypt data sent between any two processes that are identified by port numbers on network-connected hosts. Another important difference is that IPsec does not explicitly specify encryption of connections, while SSL VPNs default to encryption of network traffic.
No discussion of VPNs would be complete without mentioning SSH, which can be used to enable secure tunnels between clients and servers. SSH implements its own encryption and authentication protocols to enable secure circuits between a client and server. It is sometimes used as a sort of ad hoc VPN, such as when remote users log in to their work system to access services and systems within the enterprise network.
Understanding the pros and cons of IPsec vs. SSL VPNs begins with understanding how IPsec and SSL work to protect remote network connections. And no comparison of the benefits of IPsec vs. SSL VPNs is complete without suggestions for testing VPN products and software.
IPsec, also known as Internet Protocol Security, defines the official architecture for securing IP network traffic. IPsec specifies ways in which IP hosts can encrypt and authenticate data being sent at the IP network layer. IPsec is used to create a secure tunnel between entities that are identified by their IP addresses. IPsec VPNs typically are used to connect a remote host with a network VPN server; the traffic sent over the public internet is encrypted between the VPN server and the remote host. IPsec enables the communicating hosts to negotiate which cryptographic algorithms are to be used to encrypt or authenticate data.
This type of tunneling enables the remote user's system -- the VPN client -- to communicate with any systems behind the VPN server. The remote host negotiates the initial connection with the VPN server, after which all traffic between the remote host and any systems inside the protected network is encrypted. Authentication of network data may be negotiated between the remote host and the VPN server in addition to, or instead of, encryption. However, VPNs use encryption to obscure all data sent between the VPN client and server.
An attacker monitoring encrypted network traffic between the VPN client and VPN server would be able to see that the two hosts are communicating and would be able to identify the traffic as being encrypted with IPsec -- but that is all.
IPsec VPNs usually require each remote endpoint to use specific software to create and manage the IPsec circuits, which means they can be more complicated to set up, configure and administer than SSL VPNs.
Modern SSL VPNs actually use TLS to encrypt streams of network data being sent between processes. The TLS protocol enables encryption and authentication of connections between programs. These connections are usually defined by the IP addresses of the endpoints, as well as the port numbers of the programs running on those endpoints. TLS enables the communicating hosts to negotiate which cryptographic algorithms are to be used to encrypt or authenticate data. While some configurations permit the use of deprecated SSL versions, security best practices recommend using only the latest versions of TLS.
SSL VPNs can be used to protect network interactions between a web browser and a web server or between an email client and an email server. SSL VPN clients access specific services by connecting to the SSL VPN server, which itself acts as a proxy for the protected services inside the enterprise network.
SSL VPNs enable more granular control over connections. Whereas an IPsec VPN enables connections between an authorized remote host and any system inside the enterprise perimeter, an SSL VPN can be configured to enable connections only between authorized remote hosts and specific services offered inside the enterprise perimeter.
Operating at the transport layer also means that an external attacker monitoring network traffic may be able to identify the application protocols being used by remote users. Instead of a single tunnel circuit carrying all network interactions as with IPsec, there will be a separate network circuit for each different connection, so the attacker might be able to gain some information about the applications and services being used by remote users. SSL VPNs can be implemented without the need to install client software on remote hosts because modern TLS-enabled browser clients can be used to create secured tunnels.
The choice between an IPsec and SSL VPN should be based on the conditions and requirements of the organization. While there may be philosophical or theoretical preferences for one model or the other, the actual decision should be based on fact-based comparisons of the advantages and disadvantages as they apply to the actual deployment.
The first step in comparing IPsec vs. SSL VPNs is to determine the requirements for the organization and its users and deciding the most important features and functions of the VPN. Some of the differences between IPsec and SSL VPNs include the following:
While many of the differences between IPsec and SSL VPNs are attributable to the differences between the underlying protocols being implemented, the specific implementations should also be considered. Does the IPsec VPN implementation you prefer add features that make it functionally comparable to SSL VPN implementations? How does the implementation of either protocol VPN compare to other products from other vendors?
VPN implementations should be tested with the same degree of thoroughness as any security product. Proper testing should be preceded by research about the VPN implementations being considered. Also like other security systems and services, VPN system testing should never initially be done on production systems or networks.
VPN testing should address all security aspects, especially as they pertain to the organization's threat models and attack surfaces. VPN testing should address the following:
Ideally, enterprises would deploy both IPsec and SSL VPNs, as each one solves slightly different security issues. However, in practice, the need for complete coverage may be overbalanced by the expense of purchasing, testing, installing, administering and managing two VPN systems.
26 Jun 2019