Page 120 - StudyBook.pdf

104 Chapter 3 • Communication Security: Remote Access and Messaging

Introduction

The Security+ exam covers communication security. Data transmissions, particu-
larly via e-mail or remote access methods, are typically an entity’s most exploited
vulnerability.With the advent of high-speed Internet, securing remote access tech-
nologies has become a greater focus for security professionals than ever before.
While the ability to dial into the workplace was once a luxury afforded those who
worked for prestigious corporations on the bleeding edge of technology, nearly
everyone in corporate America now expects their employer to provide some level
of connectivity to their work environment from home.Vendors ship virtual private
network (VPN) clients as part of operating systems (OSes) or as free downloads,
and even Personal Digital Assistant (PDA) devices enable the use of VPN and
Terminal Services software. Business models have also changed to incorporate
“remote work forces” and the building of shared “network spaces” that enable
secure collaboration with partner companies who require access to company
resources.
The practice of implementing and managing e-mail communication has also
morphed. PDAs—once known as electronic DayTimers—are now pocket-sized
mobile computers running OSes that can both transmit and store e-mail and docu-
ments. E-mail is no longer “retrieved” from servers via a push/pull technology, but
is now sent to devices across the world via an over the air “push” from internal e-
mail servers. Even laptop users can establish encrypted sessions to these servers from
public locations without the use of a VPN connection via technology that comes
“out of the box” in a typical installation of Outlook. Beyond this, the concept of
“messaging” includes technologies beyond e-mail: Instant Messaging (IM) clients
are now provided by public vendors such as Yahoo! and AOL, as well as major cor-
porate solutions players like Microsoft.As such, IM solutions now include file
transfer and workspace technologies that bring both collaboration efficiencies and
vulnerabilities to the work place.
This chapter covers the technologies that a Security+ technician needs to be
familiar with when dealing with VPNs and the Point-to-Point Tunneling
Protocol/Layer 2 Tunneling Protocol (PPTP/L2TP) protocols that aid in protecting
communications.Technologies used for remote access such as Remote
Authentication Dial-in User Service (RADIUS),Terminal Access Controller Access
Control System+ (TACACS+), Secure Sockets Layer (SSL),VPN, and Citrix solu-
tions are also defined later in this chapter.

www.syngress.com