In this section, we're going to look at virtual private networks or VPNs.
VPN solutions provide for secure access across insecure medium, such as the Internet, allowing for
the connection of branch offices, home offices, business partners and remote telecommuters to all
or some part of a corporate network.
VPNs have become very popular because of low cost, high bandwidth Internet connectivity, which allows
for secure encrypted connections back to central sites.
Previously, remote offices had to connect to the central office or head office through expensive leased
lines or dial up phone lines.
VPNs have helped reduce network costs by allowing for secure connections through broadband technologies
such as DSL and cable.
These days, VPNs can transport mission critical data.
Voice over IP and client server applications without compromising quality or security.
In this section, we can look at an overview of VPNs at a level.
They just expect you to have an appreciation of VPNs.
But in my experience, I find people get really confused if you just gloss over some of the terms and
technologies and VPN components, and thus I'm going to delve into it in a little bit more detail.
We're going to explain what IPsec is, what encryption is, what authentication is, and what integrity
is.
All vital components in a VPN.
So again, what is a VPN?
A VPN is an encrypted connection between private networks over a public network such as the Internet.
So it's a virtual private network which allows for the sending of traffic securely across an insecure
medium.
Thus, you can send private data and private information across the Internet without the worry of someone
intercepting and reading your information.
To keep the data private, the traffic is encrypted so that confidentiality is maintained.
Instead of using a dedicated connection between two sites, such as a leased line, we are using a public
infrastructure such as the Internet, to send data securely from one private network, let's say a home
network where a user's telecommuting to a central office or head office, where the user's accessing,
for instance, an Oracle database.
So secure data is sent between these two private sites across the public Internet.
Now a bit of history.
Why the requirement for VPNs?
Well, IP version four was created in the 1970s, and in those days, network security wasn't a big
issue.
It's important to realize that IP transmits a lot of data as clear text, which is often referred to
as transmitting in a clear.
That is just transported into raw form with no encryption.
Lots of private information, including usernames and passwords.
So authentication information and other private data is transmitted in clear text and if captured,
can easily be read by hackers and other individuals.
Is a simple example of a sniff capture of a user logging into an FTP server and you can clearly see
that the username is anonymous available in clear text and the password of Cisco is also shown in clear
text.
So when you connect, for instance, to a web server, if that web server is not using encrypted HTTP,
your username and password, for instance, will be sent in clear text, which is easy to capture and
read.
All information transmitted in an email, for example, is sent in clear text.
So you have some examples of clear text protocols.
For instance, FTP, all the data as well as the authentication information is sent in clear text if
you are telling to a writer or a switch.
All your authentication information is in clear text.
So usernames and passwords can easily be captured as well as any commands that you type on the rudder
or switch.
So as an example, if you type show run, the entire running configuration could be captured.
There are some really powerful hacking tools available on the Internet.
Please note I don't recommend you using them, but just be aware that they exist.
An example would be Cain and Abel, which is extremely powerful and can capture usernames and passwords
from multiple protocols, including those listed here.
Just do a search for Cain and Abel in Google.
And you can see this website.
Okay.
It.
Provides Cain and Abel for free.
And has really powerful features for capturing and recovering passwords.
You use this program at your own risk.
And again, I don't recommend that you use it, but be aware that it exists.
SMTP sends the contents of mail messages in clear text, so it does pop three.
So does HTTP, so does SNMP version one.
So be aware a lot of the protocols that we use in everyday environments send information in clear text
which could be captured and read by undesirables.
Cryptography, like so many other things in life, has its own terminology.
Some of the terms that you need to understand firstly, what an algorithm is.
An algorithm is detailed steps for performing a function, and a cipher is an example of an encryption
algorithm.
We look at a lot of the algorithms in the next few slides, but as an example, days, triple days.
And these are encryption algorithms used for taking clear text data and putting it into non readable
form or ciphertext.
In other words, encrypted data.
There are two main types of encryption algorithms that we're going to look at in this course.
The first one is a symmetric algorithm.
A symmetric algorithm is where the same key is used for encryption and decryption and secret key algorithms
like days, triple days.
And these are asymmetric encryption algorithms.
An asymmetric algorithm is an algorithm in which different keys are used for encryption and decryption.
Public key algorithms such as RSA or asymmetric encryption algorithms are going to look at those in
more detail in a moment.
But just be aware that with a symmetric algorithm, the same key is used to encrypt and decrypt.
With an asymmetric algorithm, a different key is used to encrypt versus decrypt.
So what is the key?
The key is a bit of information that is required to decrypt the message, usually in the form of a value
that is used with a cipher to encrypt the message.
It's important that the key remains secret in order for the message to remain private.
Think of a key as a password.
A key or password is used with an encryption algorithm, and together they make the data secret.
Think of it as follows The algorithm is well known and can be read about in books.
You can look on Wikipedia.
There's lots of documentation explaining various algorithms like A's, triple DS and Des.
However, the key is a secret value.
A key user with an algorithm makes the data unique.
What are we trying to accomplish?
There are four things that you typically want to accomplish in a VPN.
The first one, and the one most people think about is data confidentiality or encryption, where no
one else should be able to read the information by manipulating the data that is sent across the public
infrastructure.
In other words, if a hacker captures your information on the Internet that hackers should not be able
to decrypt or read the information.
Data confidentiality is provided by using encryption algorithms with associated keys.
The second goal is data integrity and how we want to know that the data has traversed unchanged between
the two parties.
For instance, if a send something to party B, party B wants to know that that data has not been manipulated
or changed in transit.
That data has arrived without changes as it was sent by Party A.
The third goal is data origin authentication.
The receiver of the data needs to be able to verify that the data that it received could only have originated
from the sender.
In other words, the so called sender is the actual sender that we believe them to be.
The receiver wants to be able to authenticate the source of the packet that arrived, guaranteeing and
certified who the source of the information actually is.
And then the fourth goal is empty replay protection.
We want to verify that each package is unique and is not duplicated.
So he has a very basic example of confidentiality or encryption and is one of the earliest forms of
encryption used by Caesar.
Years and years ago, if a hacker captured the following text inject, what does it mean?
Well, two things have been done to this text.
The first is that an algorithm has been applied to clear text with a key.
So in this example, the algorithm used is a so called Cesar's algorithm, where data has been moved
to the right hand side and the key space or key used is five.
Now, if you reverse that process, in other words, move the letters by five to the left hand side.
This can be decrypted as hello.
Just take an alphabet.
Look at M for example, move by five letters and you'll get an H and so forth and so on.
So if a hacker captured the encrypted text, he or she would have to know firstly which algorithm was
used and secondly, what the key is.
Once you know those two pieces of information, it's just a matter of reversing the algorithm.
So there's a very simple example of data confidentiality or encryption.
This is the process involved with encryption.
We firstly take some secret data which is in clear text.
This might be an order or a confidential email or some data that is in clear text, but we want to keep
it confidential.
We then take a key in combination with an algorithm, let's say a US or advanced encryption standard.
I'll explain more about the algorithms in a moment, but for now, just understand that you take the
original data, which is in clear text.
You take a key.
You take the encryption algorithm.
The clear text, when sent through the encryption algorithm with a specific key results in ciphertext
or encrypted data.
That encrypted data can then be sent across a public infrastructure such as the internet and a non desirable,
like a hacker will not be able to read the information because it's encrypted.
The receiving party will receive the encrypted data and will reverse the process.
So in other words, by applying the same algorithm and the same key, but in the reverse direction,
the encrypted data is reversed back to the original clear text data and the receiving party can read
the information.
So it's a simple process where you take clear text data, you apply an encryption algorithm with a key
to it which results in ciphertext.
The sender then transmits that across an insecure medium, such as the Internet.
The receiver reverses the process by applying the same key.
If it's a symmetric algorithm and the algorithm but reverses the process, which results in the original
clear text data.
Now an algorithm's key space or key length is a set of all possible values for that algorithm.
I find this confuses a lot of people, so I'm going to explain it by using an IP address end.
But Keys produces a two to the N key space size.
So by looking at a class A address as an example, an IP version for addresses, 32 bits in size, the
network portion is eight bits and the host portion is 24 bits.
So two to the power of 24 gives you over 16 and a half billion options or host addresses in theory.
So think about it as follows A 24 bit key space results in over 16 and a half billion combinations.
So keep that in mind.
When we look at the key spaces available in the various algorithms, the greater the key space, the
harder it's going to be to crack the encryption algorithm because there are more combinations available.