Security

Ask something
Discussion Locked

Remote access

0 helpful
1 reply

by darchetti1

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My organization is looking to expand its remote access solution. We are currently using Citrix with Secure ID to provide access to email and some in house apps for managing sick and vacation time. We would like to expand this access for users to access a much broader array of application all through Citrix. The question of how secure the solution is comes into play.
The security folks fear worms and Trojans and site that the solution is not secure enough. The systems folks ask the question of what do people like Citibank and Chase do. They use the example of online banking and the use of static passwords and cookies. We are using secure ID so ?we should be in a better position?
Any thoughts or suggestions are welcome.

1 reply

by lordinfidel

Use a vpn solution but also limit what the end user connecting over the vpn can get to.

Online Banking is just an SSL enabled site and is not applicable for VPN style connections, although it is possible to create SSL vpn tunnels.

Unless the "secure-ID" is a unique client side variable that is seemlesly passed to the server prior to the user authenticating with a u/p, then it is not really secure.

The type of VPN connections I use is the server side and client side use x509 certs (similiar to ssl certifictaes). Each side trusts a private Root CA (that is not a publicly obtainable Root CA), each side also has the other sides public cert. And each side has it's own private key to it's own cert.

So each side does not need to know the other sides private key, only it's cert. So when side A sends Side B it's public cert, Side B looks at it and compares it to the copy of the side B cert it has locally then verifies that it is signed correctly by the Root CA. Side A also does the same with Side B's cert.

This makes for a almost impossible scenario to break, unlike PSK or RSA signatures. Since the only way that someone can hack this scenario is by breaking into the Root CA, generating a cert of themselves, then adding their profile onto the authenticating server.

see www.openswan.org for more information on VPN's

This discussion is closed to new replies.