- Now in 11.4, we're going to do our first lesson
on secure communications.
We're gonna revisit secure communications again
in a later lesson.
A secure protocol is going to be a set
of rules and procedures designed to ensure
that we have secure communication between two
or more parties over a network or the internet.
Now the objective of secure communication
or secure protocol is either confidentiality,
integrity, authentication, non-repudiation
or really any combination of those.
We're going to be talking specifically
about two protocols in this lesson, TLS and IPSec.
TLS or Transport Layer Security
and IPSec is Internet protocol security.
And they both are widely used to secure online transactions,
email communication, and other sensitive data transmissions.
But before we talk about TLS
we have to talk about SSL.
And I know we've talked a little bit about SSL already
but I wanna talk some more about SSL.
So SSL, Secure Socket Layer, what's the history?
Well, it was developed back in 1995 by Netscape.
SSL, Secure Socket Layer, is used to establish
a secure communication channel
by negotiation using a stream cipher
and SSL communicates on port 443.
So basically the source would say
to the destination, hey, destination, I wanna talk to you.
The destination says would say, cool
but we need a secure channel.
And the the source would say, okay,
well let me tell you what I am capable of.
And then based on negotiating that, right,
the destination will say, okay,
this is how we're going to have a secure channel
communicating on 443.
So what's the current state?
Well secure sock layer SSL is insecure and outdated.
In 2015, SSL 3.0 was deprecated, meaning found to be weak
by the internet engineering task force, the IETF,
due to numerous security vulnerabilities
that have been discovered over the years
and new vulnerabilities continue to be discovered.
So we don't wanna be using SSL anymore.
Matter of fact, most browsers no longer support SSL
and we wanna make sure that SSL previous versions
like 2.0 and 3.0 are disabled, right?
Because when they're enabled, it makes the system vulnerable
to an attack we've already discussed
which is a downgrade attack.
So what are we gonna use instead if we're not using SSL?
Well, that's where TLS comes in.
Introduced in 1999, transport layer security is used to
establish a secure communication channel
by using a cryptographic key exchange.
And you're familiar with those.
We've seen how cryptographic key exchanges work.
TLS communicates on port 443.
Now one of the confusions I think about TLS
is that a lot of us still, hopefully I don't,
but a lot of us do still use the term SSL
when we mean TLS because we've been using SSL for so long
that even though we've already transitioned to TLS,
people will still use the term SSL
and it gets even a little more confusing
'cause it runs on the same port.
It runs on port 443.
So if you're talking to someone and they're talking
about SSL, don't hesitate to stop them and say
do you mean SSL or TLS?
You know, you won't sound wonky.
You'll sound like you really just trying to understand.
So TLS is a successor and the recommended
replacement for SSL.
TLS is used to provide confidentiality,
integrity and authenticity.
Now, TLS uses a block encryption cipher
and does include some advanced security features
and improved algorithms.
Now the current version of TLS is 1.3
and you always wanna be using the current version.
So as a new version comes out,
you'll wanna move to a new version
and the IETF has officially declared
that both TLS 1.0 and TLS 1.1 are deprecated,
again meaning weak and vulnerable and should not be used.
So let's take a look at how a TLS session actually works,
how a connection is made.
First, a client does a hello command
and that's really the secure connection requesting
a TLS version, supported ciphers and a random number.
The server does a "hello",
which is really a secure connection response
including TLS version, selected cipher suite
and a random number.
Then we have a certificate exchange here.
The server's going to send its digital certificate
which contains the server's public key
and other trusted information to the client.
Then we have a server key exchange
where the server's going to send its public key.
Remember, public keys are freely distributed,
to the client along with information needed
to establish a shared secret or a symmetric key.
Remember, symmetric key is where you use the same key
to encrypt and decrypt.
Why are we using a symmetric key?
Because it is computationally efficient
and works well in large blocks of data.
Then we'll have a client key exchange
where the client generates a symmetric key,
encrypts it with the server's public key
and sends it back to the server.
Then we'll have our cipher specification where
both the client and the server switch
to the agreed upon cipher suite using that symmetric key.
And then we have confirmation, the client
and the server exchange messages to verify
that a secure connection has been established.
Next step, we wanna talk about IP security
or internet protocol security, often referred to as IPSec
which is a protocol suite used to secure IP
or internet protocol communications
by providing authentication, integrity
and confidentiality services.
Now introduced in the mid 1990s, IPSec was originally
designed to secure host to host communication.
Now, IPSec operates at the network layer of the OSI model.
That's layer three and can be used
to encrypt data being sent to any system
that can be identified by an IP address.
Now IPSec can be implemented in two modes, tunnel mode
which is a default mode and transport mode.
Now, even though IPSec was originally designed just
to secure kind of host to host communication, right,
inside a a server room, at that point
IPSec has now become the defacto standard for IP-based VPNs.
So looking at our two IPSec modes, we have tunnel mode.
In tunnel mode the entire IP packet is encapsulated
to become the payload of a new IP packet.
And a new IP header is added on top
of the original IP packet.
So in tunnel mode, entire thing, right?
The entire packet is gonna be encapsulated
and it becomes the payload of another packet.
And that other packet will have a new header.
In transport mode, the payload is encrypted,
but not the IP header information.
So we don't have to have a packet on top of a packet.
Transport mode has less overhead
but could be considered less secure.
So tunnel mode's gonna be used for configurations
that need a really secure connection
between two different networks.
So I just mentioned that IPSec was a defacto standard
for VPNs so let's talk about VPNs.
VPNs is a virtual private network designed
to facilitate secure remote access communication
over a public network.
And what's the public network we're talking about?
Of course, over the internet.
VPNs are an incredible cost-effective alternative
to dedicated point-to-point connections like a T1
or a T3 or an E1 or E3 which were very expensive
and you'd have to go to the, you know,
a phone company to get and you might have to wait weeks
or even months till it got installed.
Now we can just use the circuitry
of the internet for this communication.
VPNs isolate network frames from the surrounding networking
by using a process known as encapsulation or tunneling.
Full tunneling requires that all traffic is routed
over the VPN and split tunneling says some traffic
can go over the VPN and some
can directly access the internet.
So imagine you're at home, you connect
via your VPN to the office.
Full tunneling means everything you do
goes through that tunnel.
Split tunneling would be okay,
I am connected to the office through my VPN
but I can also go out directly
to the internet without going through that VPN.
That would be split tunneling.
Now, the two most used protocols for virtual private network
or VPN are gonna be are IPSec and TLS.
Now IPSec VPNs are widely used for site to site VPNs
and remote access VPNs.
Now because IPSec operates at OSI layer three,
IPSec VPNs can support all IP-based applications.
TLS VPNs are commonly used
for remote access VPN configurations.
Because TL operates at the OSI layer seven, right,
TLS VPNs generally only support browser-based applications.
I wanna just briefly introduce you to two more concepts
of ways that we can further secure our networks.
And the first is having software-defined
wide area networks or SD-WANs.
A software defined wide area network is a technology
that enables the creation of a software-defined
network overlay over an existing wide area network.
So why would we do that?
Well, the SD-WAN focuses
on providing software defined application routing
to the WAN but it includes built-in security features
such as encryption, firewalling, and threat detection
and response to improve the security of the network.
The other concept I want you to become familiar with
is known as Secure Access Service Edge or SASE,
which is a cloud-based network security model
that really combines wide area networking
and security functions into a single cloud-based service.
Now, SASE is based on the principle of software-defined
networking and the SASE architecture
integrates various security functions
such as a secure web gateway, a firewall-as-a-service,
a secure access gateway, a cloud access security broker
and zero trust network access
into a single unified in the cloud platform.
That was a lot of stuff, wasn't it?
Yeah, let's do a three second challenge together.
Five challenge questions, three seconds each.
You ready?
1, 2, 3.
We're gonna start.
This protocol is a successor to SSL.
1, 2, 3.
That's gonna be TLS.
Number two, OSI layer three protocol suite
that can be used to encrypt data being sent
between any systems identified by an IP address.
1, 2, 3.
That's gonna be IPSec.
Number three, in this IPSec mode
the entire original IP packet is encapsulated
to become the payload of a new IP packet.
1, 2, 3.
It's gonna be tunnel mode.
Number four.
This VPN encapsulation approach allows the routing
of some traffic over the VPN while letting other traffic
directly access the internet.
1, 2, 3.
That's gonna be split tunneling.
And lastly, number five.
This cloud-based network security model
combines wide area networking
and security functions into a single cloud-based service.
1, 2, 3.
That's gonna be secure access service edge, SASE.
Not an easy thing to say.
All right, that takes us to a security-in-action
about secure communications and VPN options.
Your company is growing rapidly.
Two remote offices are planned, and employees
in emerging markets are being asked to work from home.
They'll be connecting to an on-premises data center
and cost is a consideration.
What is your best option for expanding
your network securely?
So we talked about different VPN options.
Based on what we're doing, two remote offices
plus employees working from home,
they're connecting to an on-premise data center
and cost is a consideration.
So go ahead and put me on pause.
Think about what your best options are
for expanding your network security.
Well, here's some of your options.
For the remote office, we're going
to have site to site, right?
We're not doing individuals, you know, host to host,
we're doing site to site.
So promptly our best bet is gonna be
a site to site IPSec VPN, right?
So remote office to corporate.
Now for work at home users,
it's gonna be important to get an understanding of
how often and with what applications they need to connect.
Because our options to consider will be a TLS VPN
which is browser based, or a host to site IPSec VPN.
So hard to know, we don't have really have enough
information to really make a recommendation
for our home users but we can explore both
by saying what do we need to do?
What are they gonna be doing?
How often they can gonna connect, through what applications?
That'll help us kind of further refine
what our recommendations are gonna be.
Been able to do this?
Absolutely.
Security in action.
All right, there's your word cloud.
You know what to do.
Do not move on until you're really comfortable
and confident with all of these terms and concepts.
And when you are, head on over
to our lesson quiz and I'll see you there.