Chapter 8. IP Security

So far, I've examined a number of security mechanisms, including how to store data securely and how to prove your identity to local and network computers. Many nefarious individuals are foiled by strong authentication and secure data storage, but plenty of attackers won't be deterred by them. With IPSec, you can implement an additional security measure on your network that will make it difficult for even the most determined attackers.

An attacker outside your network often attempts to gain access to your network resources by guessing passwords, probing servers for open TCP/IP ports, and so on. Another more subtle method is to capture and analyze data sent to and from the network. Many network services and applications transfer information such as usernames and passwords over the network in clear text, and attackers can use this information to gain access to your network.

For example, if your company uses Windows domains, all your network users are given usernames and generally make up passwords for themselves. They also probably belong to web sites like Yahoo!, where they maintain private accounts. Many users will set their Yahoo! (or other web service) passwords to the same as their company network passwords. After all, one password is easier to remember than a dozen. The problem is that Yahoo!?and many other network services?don't encrypt passwords as a part of their logon process by default. The result is packets of data transmitted from your company network over the Internet to a Yahoo! server, containing user passwords, completely unencrypted. Attackers watch for this type of data and capture it from outside your network. Once they do, they start using the passwords they find as a basis for attacking your network. This potential for data interception is why it's important to use web sites that offer SSL encryption of sensitive data.

The problem of unencrypted network transmissions isn't limited to the Internet, though. Earlier in this book, I discussed the need for physical security of a network. If attackers gain physical access to your network, their work is greatly simplified. They can simply monitor and record all network communication, and eventually they will get the information they desire. Whether this information is confidential documentation, a database of usernames and passwords, or some other secret information, a physical compromise of the network allows unprotected data to be captured. In this case, attackers don't need to guess passwords or other credentials, as they can simply grab the data they want directly from the network as it's transmitted between computers. IP Security protects against this type of attack by protecting sensitive data on the network. In this chapter, I explain how IPSec works in enough depth to make it clear how it provides security and authenticity. I also show you the right and wrong ways to use IPSec. Because although any fool can deploy an IPSec policy, understanding the technology's strengths and pitfalls will help you make the right decision and provide exactly the right level of security.