ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityHard
A company is implementing a new cloud-based application that processes highly confidential customer data. The security team requires that all communication between the company's on-premises network and the cloud application be encrypted, authenticated, and secured against eavesdropping and tampering. This secure channel must operate at a layer that is transparent to the end-user applications and provides end-to-end protection for the entire communication. Which technology is the most appropriate choice for establishing this secure communication channel?
- ASSL/TLS for applications
- BHTTPS
- CSSH Tunneling
- DIPsec VPN
Show answer & explanationAnswer & explanation
Correct answer: D. IPsec VPN
IPsec VPN operates at the network layer (Layer 3), providing transparent, end-to-end encryption and authentication for all traffic between two networks (site-to-site) or a host and a network (remote access). This ensures all communication, regardless of the application, is secured against eavesdropping and tampering, fulfilling the requirements for a transparent and comprehensive secure channel.
Why the other options are wrong
- A. SSL/TLS secures communication at the transport layer for specific applications, requiring application-level integration, which is not transparent to all applications.
- B. HTTPS secures web traffic at the application layer, not all communication between networks transparently to all applications.
- C. SSH tunneling creates a secure channel for specific TCP ports and is typically used for remote access or forwarding, not for securing all network-layer traffic transparently.
IPsec VPN
A Virtual Private Network (VPN) implementation that uses the IPsec protocol suite to provide secure, encrypted, and authenticated communication over an untrusted network like the internet.
- Operates at the network layer (Layer 3).
- Provides confidentiality, integrity, and authentication.
- Can be configured as site-to-site or remote access VPNs.
Memory trick: IPsec VPN is the 'Invisible Shield' for network journeys.