CISSP Preparation - IPSec Explained

When it comes to discuss about Remote Connectivity technology and solution, one should see where actually all the technologies and acronyms actually stand. IPSec is one of most commonly used acronyms and needs a closer focus.

Any information exchange from or to a company location with off-premises (either a remote-site or a telecommuter) should meet confidentiality, integrity, authentication requirements in terms of information security. Technologies meeting these requirements are not many and can be grouped as below.

Virtual Private Networks (VPNs) can be established as

·         Site to Site (Connecting remote sites to hubs)

·         Remote Access (Connecting individuals to company networks)

VPNs may also be classified per technology as following:

·         IPSec (More suitable for Site-to-Site VPNs, may require more configuration or client software)

·         SSL VPN ( Easier to establish for clients, a specific client software is not needed most of the times)

Protocols like PPTP and L2TP are not mentioned in this classification because they are no longer considered as viable alternatives and their use in industry is limited comparing to aforementioned technologies.

I personally am configuring and troubleshooting IPSec VPNs for more than 5 years and have been asking myself many times whether I should keep the configuration long and complicated or not. The question goes further about the choices for different algorithms to use in different phases of IPSec, such as “should I really configure Diffie-Hellman algorithm for phase 2 or not”. After this article, I hope you will be able to answer these questions by yourselves.

Before starting to dive into more detail some important concepts about IPSec should be known. IPSec supports 2 modes of operation, Tunnel mode and Transport mode. Tunnel mode is used for end-to-end communications in remote locations (requiring a tunnel IP at both ends, easing the routing operations) while Transport mode is preferred more in Gateway to Gateway communications. I can say that 99% of the times Tunnel mode is preferred and offered by default in devices.

The second important thing to know is the packet structure.

AH (Authentication Header) protocol offers an authentication header in front of the payload providing a means of integrity, authentication and non-repudiation. However it does not deal with encryption and does not provide confidentiality.

ESP (Encapsulating Security Payload) protocol encapsulates the original packet header and payload inside a new authentication header and IP header. This provides integrity, authentication and non-repudiation just like in AH protocol. Furthermore, ESP also encrypts the initial payload and header providing confidentiality.

So, to start with, we have 2 network devices defining the perimeters of 2 remote locations which are so far connected to each other over Internet only. I suggest you to remember asymmetric cryptography whenever you see “Internet” word involved in a communication.

Before any IPSec operation configured, decision about which protocol and mode for IPSec should be made and respected at both sides. Configuration steps should be followed according to this decision.

Our remote sites, having no secure way to exchange keys periodically, look for a solution to establish a communication through which they can send and receive information in a secure manner.

IPSec establishes a 2 phase method to solve that problem.

IPSec Phase 1 sets a primary communication channel between the peers for their internal communications and the most important of all, for the exchange of secret keys, which are going to be used for faster encryption in Phase 2.

IPSec Phase 2 is actually the phase where communications between endpoints in remote locations are sent securely.

IPSec Phase 1 uses asymmetric cryptography and should pay attention to:

Hashing               : Needed for integrity check. Uses MD5 or SHA-1

Authentication : Needed for the authentication of peers. Pre-shared keys or Certificates can be used.

Group                   : Group represents the Diffie-Hellman algorithm group to securely exchange secret keys over Internet.

Lifetime              : Lifetime represents how long the secret keys, established at the end of Phase 1 will be valid. At the end of lifetime, new secret keys should be exchanged for Phase 1.

Encryption          : Encryption method for secret keys should be defined. These should be symmetric algorithms such as 3DES or AES.

When these parameters are correctly set at both ends of an IPSec connection, negotiation for IPSec Phase 1 can start. IPSec Phase 2 negotiations can start only after Phase 1 negotiations are successfully completed and secret keys are exchanged.

During Phase 2 of IPSec, a number of parameters should be set in order to allow data communications for both ends to start. These parameters should be listed as:

Encryption          : Encryption algorithm for Phase 2. (Can be different from Phase 1, this algorithm will encrypt the actual data.)

Hashing               : Hashing algorithm for Phase 2. (Also can be different from Phase 1.)

Lifetime              : Validity period of keys used in Phase 2.

Group                   : If different keys from those who were obtained during Phase 1 are planned to be used, Diffie-Hellman algorithm should be chosen to re-exchange keys.

Once Phase 2 negotiation is finished and unidirectional Security Associations (SAs) are established, secure data communications between gateways or endpoint can finally start.

I am perfectly aware that this explanation document is not as clear as an RFC document but I still think that it can be help you understand the basics of IPSec VPNs faster.

Please feel free to share your views on any points on this article.

CISSP Preparation - Access Controls

I am working with Access Control issues since the first security audit I participated, more than 10 years ago, but I must admit that I never approached to the issue the way it is demonstrated in CISSP. The structural approach for makes the understanding of different types of Access Control methods but it also brings some level of confusion.

Let's remember how ISC² categorizes Access Control methods by type. Access Control activities fall into one of Administrative, Technical and Physical types, which is crystal clear, no confusion so far. Other than these types there are categories which are Preventive, Deterrent, Detective, Corrective, Recovery and Compensating. That's where things start to get complicated.

For CISSP Preparation purposes, it is advised to think about the context in which the access control element employed. To be clearer, let's think about Firewalls. As we all agree, Firewalls are preventive control elements, point. But some people also think that (they are completely right to think that way, by the way) intruders who try to attack a company will discover the presence of a firewall and stop attacking, so it can also be considered as a deterrent control. But for exam purposes, it has to fall in only one of the categories and that will be Preventive. So far, so good.

Compensating controls can be considered a part from the other 5. Compensating controls, as the name implies, replace another control because of a convenience (it is mostly financial). Your company may choose, instead of building a highly secure room to store sensitive information for $300,000 to employ a security guard who in the end costs just $60,000 (numbers are just given for the example, really do not how much security guards are paid :)). This is a good example for compensating controls. I am sure you have seen many others around you.

From the 5 that are left, corrective and recovery controls can be mixed by many (including me!) They explain the way controls work as such: Prevent people from accessing to the information they are not authorized, if you fail then use detective controls to discover how they did it and what they change. Then try to correct the things that have been changed. If it is not possible to correct, then recover the systems to their last known working state. This flow completely makes sense. However, someone can please explain me how System Images are corrective controls rather than recovery?

Below, you can find some examples to control elements and how they are categorized. Actually I wanted to embed an excel table, but both my poor blogging skills and Blogger unfriendliness did not allow me to.The explanation show the classification made in books and the second answers in paranthesis show my opinion. Please share your opinion with me.

Fence : Physical, Deterrent (Preventive)

Lighting : Physical, Deterrent (Detective)

Server Images : Technical, Corrective (Recovery)

CISSP Preparation

I am on my way to get CISSP certification and I believe it is an important point to prove your capabilities and experience when working in IT and Security Management Domains.

I will be sharing my studying experiences, notes and points that I consider interesting, which may help others like , just for your consideration or your journeys to get certified.

First of all, I must say that I am really surprised in a good way to see how cool CISSP certification is. I used to see such certifications focused either on technical or management side of business and never covering both. I can easily name CISM certification for purely management practice, which is very very dry, hard to read and follow for people who are involved in the technical side of IT business. For technical certifications, CCNP Security or Checkpoint's CCSA and CCSE can be counted. Asking a security administrator, who is willing to see the bigger picture, the management side of things, which of course requires more responsibility, to make a formal Risk Assessment definitely changes the way he looks at the security business from that moment on. The opposite view is also true and meaningful; I personally have seen many auditors and consultants auditing organizations without having necessary knowledge on technical issues, thus realizing incomplete assessments.

I am planning to share my experiences per domain (10 in total) in Common Body of Knowledge (CBK) of ISC², but also want to deep dive in some important subjects which need to be discussed or paid attention. It is not really rare that I disagree with something written in preparation resources during my own CISSP preparation. It would be nice for me to have your opinion on these subjects.

The notes I am going to share will be in form of cheat sheets or short study notes to be read in 30 minutes max. , and the level of explanations will be as easy as for 5 years olds (Yeah, that's how I like :)). However, as they are prepared for my own studies in the first place, some very obvious points may be omitted, I am sorry for that (Those are mostly points about Communication Networks in Domain 2). 

I hope you will find some lines here that can help you sometime in your long career as well as in your CISSP preparation in this blog.