ISC2 CISSP (Certified Information Systems Security Professional)Communication and Network SecurityMedium
A security architect is designing a secure remote access solution for employees working from home. The solution must provide secure, encrypted communication between the employee's device and the corporate network over the public internet. It should also support various client operating systems and be relatively easy to deploy and manage. Which of the following secure communication channels is BEST suited for this scenario, providing both confidentiality and integrity?
- AIPsec VPN
- BTelnet
- CHTTP
- DSSH VPN
Show answer & explanationAnswer & explanation
Correct answer: A. IPsec VPN
An IPsec VPN provides a secure, encrypted tunnel over an unsecure network (like the internet). It offers strong confidentiality, integrity, and authentication. IPsec is widely supported across various operating systems and devices, making it a robust and manageable solution for remote access to corporate resources.
Why the other options are wrong
- B. Telnet is an unencrypted protocol, highly insecure for remote access over the internet.
- C. HTTP is also unencrypted and unsuitable for secure remote access; HTTPS would provide some security but not a full network tunnel.
- D. While SSH can create tunnels, an SSH VPN is typically more complex to manage and less robust for enterprise-wide remote access than IPsec VPNs.
IPsec VPN
A Virtual Private Network (VPN) solution that uses the IPsec protocol suite to establish secure, encrypted connections over an untrusted network, such as the internet. It provides confidentiality, integrity, and authenticity for data in transit.
- Operates at the network layer (Layer 3).
- Uses Authentication Header (AH) for integrity/authenticity and Encapsulating Security Payload (ESP) for confidentiality/integrity/authenticity.
- Supports two modes: Tunnel mode (for networks) and Transport mode (for hosts).
- Widely used for site-to-site and remote access VPNs.
Memory trick: IPsec Protects Internet Privacy Securely.