CompTIA SecurityX (CAS-005)Security OperationsMedium
A security architect is designing a new secure communication channel for an organization's remote workforce. The primary requirements include ensuring data confidentiality, integrity, and authenticity, even over untrusted networks. The solution must also support various client operating systems and be relatively straightforward to implement without requiring extensive client-side software installations beyond standard OS capabilities. Which of the following protocols would be the MOST appropriate choice for this scenario?
- ASSH (Secure Shell)
- BSSL/TLS VPN (Secure Sockets Layer/Transport Layer Security Virtual Private Network)
- CL2TP/IPsec (Layer 2 Tunneling Protocol with IPsec)
- DPPTP (Point-to-Point Tunneling Protocol)
Show answer & explanationAnswer & explanation
Correct answer: B. SSL/TLS VPN (Secure Sockets Layer/Transport Layer Security Virtual Private Network)
SSL/TLS VPNs are widely supported across various operating systems, often integrated into web browsers or lightweight client applications, making them relatively straightforward to implement for remote access. They provide strong confidentiality, integrity, and authenticity through TLS.
Why the other options are wrong
- A. SSH primarily provides secure remote access to command-line interfaces and file transfers, not a full-fledged network-level VPN for general remote workforce access to internal resources.
- C. L2TP/IPsec provides strong security but often requires more complex client-side configuration and dedicated client software compared to SSL/TLS VPNs, which can be browser-based.
- D. PPTP is considered insecure due to known vulnerabilities and weak encryption, making it unsuitable for confidential data.
SSL/TLS VPN
A Virtual Private Network (VPN) solution that uses the Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocol to create a secure, encrypted connection over an untrusted network.
- Operates at the application layer (OSI Layer 6/7).
- Often uses a web browser as the client, simplifying deployment.
- Provides strong encryption, authentication, and data integrity.
Memory trick: Very Prudent VPNs Secure Virtual Paths.