2 Reviewing IPSec Understanding Vulnerabilities Threat Analysis What Is IPSec?Microsoft IPSec FeaturesAdvantages and Disadvantages of IPSecIPSec Security ServicesAuthentication MethodsHow IPSec Is Deployed
3 Threat Analysis Identify threats Prioritize threats based on: Probability of occurrenceSeverity of potential damageDivide the number representing damage by the number representing probability to determine the threat levelAddress threats with the highest threat levels first
4 1. Threat A has been identified as having a high amount of damage ExampleAssume that you have identified two potential threats to your enterprise:1. Threat A has been identified as having a high amount of damage(Damage = 10) and a low probability of occurring (Probability = 10),so the threat level is 1 (10/10 = 1).2. Threat B has been identified as having a high amount of damage(Damage = 8) and a fairly high probability of occurring (Probability = 3),so the threat level is 2.67 (8/3 = 2.67).Therefore, you would address Threat B first, because it has a higher threat level.
5 What Is IPSec?Can use security protocols to encrypt or digitally sign trafficCan use tunnel mode to secure traffic between two networksRouterTunnel ModeCan use transport mode to secure traffic between any two hostsTransport ModeRouter
6 Internet Protocol Security (IPSec) is a set of extensions to the Internet Protocol (IP) family. It provides cryptographic security services that allow for authentication, integrity, access control, and confidentiality.IPSec services are similar to Secure Sockets Layer (SSL), but at the network layer, in a way that is completely transparent to your applications and much more powerful. This is because your applications do not need to have any knowledge of IPSec to be able to use it.You can create encrypted tunnels, (virtual private networks [VPNs]), or simply perform encryption between computers.The many options offered by IPSec make it much more complex than SSL.
7 Microsoft IPSec Features ImplementationDescriptionPolicy-based configuration managementMakes configuration, implementation, and administration easierIPSec functionality over NATAutomatically detects the presence of a NAT device and uses UDP-ESP encapsulation to allow IPSec traffic to pass through the NATIPSec certificate-to-account mappingAllows you to set restrictions on which computers are allowed to connectDefault traffic exemptionsExempts only Internet Key Exchange (IKE) traffic from IPSec filteringCommand-line managementScripts and automates IPSec configurationComputer startup securityPermits only the following traffic during computer startupPersistent policy for enhanced securityIs applied before the local policy or the Active Directory–based policy
8 IPSec is based on an end-to-end security model that establishes trust and security from a source IP to a destination IP address. Any computers that only route data from source to destination are not required to support IPSec, unless firewall-type packet filtering or network address translation (NAT) is in place.This model allows for the successful deployment of IPSec in the following enterprise scenarios:Local area network (LAN): client/server and peer-to-peerWide area network (WAN): router-to-router and gateway-to-gateway using IPSec tunnelsRemote access: dial-up clients and Internet access from private networksIPSec tunnel modeWhen you use IPSec tunnel mode, IPSec encrypts the IP header and the payload. Tunnel mode provides the protection of an entire IP packet.IPSec transport modeTransport mode is the default mode IPSec encrypts only the IP payload.
9 Advantages and Disadvantages of IPSec Flexible security protocolsTransparent to users and applicationsAuthenticationConfidentialityOpen industry (IETF) standardsData integrityDynamic rekeyingSecure end-to-end linksEasy implementation and centralized management by using policiesDisadvantagesAdministrative overheadIncreased performance requirementSupportabilityPolicy managementLocal policy configuration
10 IPSec Security Services FeatureDescriptionAutomatic key managementIKE services dynamically exchange and manage keys between communicating computersAutomatic security negotiationIKE services dynamically negotiate a common set of security settings using IKE servicesPublic key infrastructure supportIPSec supports the use of public key certificates for authenticationPreshared key supportIPSec can use a preshared key for authentication
11 Authentication Methods Kerberos V5The default authentication method for IPSecPublic key certificatesUsing this authentication method, security credentials can be presented without being compromised in the processPreshared key authenticationBoth parties agree on a shared, secret key that is used for authentication in an IPSec policy
12 Using policy-based management How IPSec Is DeployedUsing policy-based managementEasy managementEasy implementationEliminates administrative overheadUsing local policiesOne local policyGroup Policy settings can be stored on individual computers
13 Policy-based configuration management You can assign IPSec policies through Group Policy configuration of Active Directory domains and organizational units.This allows the IPSec policy to be assigned at the site, domain, or organizational unit level, eliminating the administrative overhead of configuring each computer separately.IPSec Encapsulating Security Payload (ESP) packets can now pass through a NAT device that allows UDP traffic. The Internet Key Exchange (IKE) protocol automatically detects the presence of a NAT device and uses UDP.ESP encapsulation to allow IPSec traffic to pass through the NAT device.Refs: