1. What do we secure?

2. Against what do we secure

3. How do we secure

Content
I. DEFINITION OF CONCEPTS
a. Vulnerability
b. Threat
c. Attack
d. Impact
e. Risk
II. TYPES OF ATTACK
a. Passive Attack
I. Types of passive attacks
b. Active Attack
I. Types of active attack
III. MALWARE
a. Types Of Malware
i. Viruses
ii. Worms
iii. Trojan Horse
b. Method Of Spread Of Malware
i. Email
ii. Web
iii. Direct (USB, SD-Card, etc)
c. Methods to fight Against Malware

A core requirement of information security for the safe utilization, flow, and storage of information is
the CIA triad. CIA stands for confidentiality, integrity, and availability and these are the three main
objectives of information security. Confidentiality ensures that information is hidden from people
unauthorized to access it. The confidentiality principle dictates that information should solely be
viewed by people with appropriate and correct privileges. The main method to ensure data
confidentiality is cryptography. Data integrity is defined as maintenance and assurance
of data consistency and accuracy throughout its life-cycle. Error checking and validation, for example,
are common methods for ensuring data integrity as part of a process. “data availability” refers to the
ability to ensure that required data is always accessible when and where needed within an
organization's IT infrastructure, even when disruptions occur.

I. DEFINITION OF CONCEPTS
In order to have a strong grip on data security issues that may potentially impact businesses, it is
imperative to understand the relationship between these central components: vulnerability, threat,
Attack, Impact and risk. Though these technical terms are used interchangeably, they are distinct terms
with different meanings and implications.

a. Vulnerability
A vulnerability refers to a known weakness of an asset (resource) that can be exploited by one or more
attackers. In other words, it is a known issue that allows an attack to succeed. For example, when a
team member resigns and you forget to disable their access to external accounts, change logins, or
remove their names from company credit cards, this leaves your business open to both intentional and
unintentional threats. Testing for vulnerabilities is critical to ensure the continuous security of your
information or systems. Here are some questions to ask when determining your security vulnerabilities:

 Is your data backed up and stored in a secure off-site location?

 Is your data stored in the cloud? If yes, how exactly is it being protected from cloud
vulnerabilities?

 What kind of network security do you have to determine who can access, modify, or delete
information from within your organization?

 What kind of antivirus protection is in use? Are the licenses current? Is it running as often as
needed?

 Do you have a data recovery plan in the event of a vulnerability being exploited?

b. Threat
A threat refers to a new or newly discovered incident that has the potential to harm a system or your
company overall. There are three main types of threats:

 Natural threats, such as floods, hurricanes, or tornadoes

 Unintentional threats, like an employee mistakenly accessing the wrong information

 Intentional threats, such as spyware, malware, adware companies, or the actions of a

disgruntled employee

Most recently, on May 12, 2017, the WannaCry Ransomware Attack began bombarding computers
and networks across the globe and has since been described as the biggest attack of its kind. Cyber

criminals are constantly coming up with creative new ways to compromise your data. Threats may be
uncontrollable and often difficult or impossible to identify in advance. Still, certain measures help you
assess threats regularly: example:

 Ensure your team members are staying informed of current trends in cybersecurity so they can
quickly identify new threats. They should join professional associations so they can benefit
from breaking news feeds, conferences, and webinars.

 Perform regular threat assessments to determine the best approaches to protecting a system
against a specific threat, along with assessing different types of threats.

 Conduct penetration testing by modeling real-world threats in order to discover vulnerabilities.

c. Attack
An attack is the manifestation of a threat that involves an attempt to obtain, alter, destroy, remove,
implant or reveal information without permission. Much about attacks will be discussed later in this
chapter.

d. Impact
These are the damages a company will incur when an undesired incident happens. The Impact and the
Risk are very closely related, and can be used interchangeably. So, we can say that, the impact is the
cost of a risk.

e. Risk
Risk is defined as the potential for loss or damage when a threat exploits a vulnerability. Examples of
risk include financial losses, loss of privacy, reputational damage, legal implications, and even loss of
life. Risk is governed by one equation: Risk = Likelihood x Impact. This means that the total amount
of risk exposure is the probability of an unfortunate event occurring, multiplied by the potential impact
or damage incurred by the event. In terms of thread and vulnerability, Risk = Threat X Vulnerability.

II. TYPES OF ATTACK

There are two main types of network attacks, namely: Passive and Active attacks.

a. Passive Attack
A passive attack is an incident or event that involves monitoring or scanning communications,
information flows or systems. In most cases passive attacks are very difficult to be detected, because
they simply monitor, as opposed to trying to break into a system. Below are some examples:

 Tapping: Monitoring unencrypted communications, such as emails or telephone calls.

 Encryption: Intercepting encrypted information flows and trying to break the encryption.
 Scanning: Scanning a device connected to the internet for vulnerabilities such as open ports or
a weak operating system version.
 Traffic Analysis: Monitoring internet traffic to build data such as Who is visiting What
Website.

b. Active Attack
An active attack, is an attack characterized by the attacker attempting to break into the system. During
an active attack, the intruder may introduce data into the system as well as potentially change data
within the system. Below are some examples:

 Masquerade attacks (A wolf in sheep’s clothing): This is when an entity (usually a computer
or a person) takes on a false identity in order to acquire or modify information. It includes
impersonating legitimate sources and creating fake identities. Masquerade attacks can also
incorporate other categories.
 Message replay: It involves the re-use of captured data at a later time than originally intended
in order to repeat some action of benefit to the attacker: for example, the capture and replay of
an instruction to transfer funds from a bank account into one under the control of an attacker.
This could be foiled by confirmation of the freshness of a message.
  Message modification: could involve modifying a packet header address for the purpose of
directing it to an unintended destination or modifying the user data.
 Denial-of-service (DoS) attacks: prevent the normal use or management of communication
services, and may take the form of either a targeted attack on a particular service or a broad,
incapacitating attack. For example, a network may be flooded with messages that cause a
degradation of service or possibly a complete collapse if a server shuts down under abnormal
loading. Another example is rapid and repeated requests to a web server, which blocks
legitimate access to others. Denial-of-service attacks are frequently reported for internet-
connected services.
III. MALWARE

Malware is any piece of software program that was written with the intent of damaging devices,
stealing data, and generally causing a harm.

a. Types of Malware

Viruses, Worms, Trojans, spyware, and ransomware are among the different kinds of malware.

i. Viruses

Like their biological namesakes, viruses attach themselves to clean files and infect other clean files.
They can spread uncontrollably, damaging a system’s core functionality and deleting or corrupting
files. They usually appear as an executable file (.exe). Creeper was the first virus developed in 1971,
that infected PDP-11 computers connected to ARPANET, the Defense Department-run precursor to the
Internet. Once infected, the computer would display the message, "I'm the creeper, catch me if you
can!" Self-replicating but not too dangerous, Creeper opened the door that the rest of this list walked
through. Other examples now include: Blaster, Slammer, Nimda, Code Red, ILOVEYOU.

ii. Worms

A computer worm is a type of malware that spreads copies of itself from computer to computer. A
worm can replicate itself without any human interaction, It exploits the communication links (network)
of the infected computer to attack other computers connected to it directly or indirectly. Examples
include:

The Morris Worm was launched in 1988 by Robert Morris, an American student who wanted to
discover how big the internet really was. To do this, he launched a few dozen lines of code, but he
didn’t know that the code was riddled with bugs that would cause a variety of problems on affected
hosts. The result was thousands of overloaded computers running on UNIX and a financial damage
ranging between $10 million and $100 million. Other examples include Storm Worm, SQL Slammer

iii. Trojan Horse

This kind of malware disguises itself as legitimate software, or is hidden in legitimate software that has
been tampered with. It tends to act discreetly and create backdoors in your security to let other malware
in. Example:

 Exploit: It contains data or code that abuses a vulnerability within application software that’s
operating on your endpoint.
 Backdoor: It gives malicious users remote access over the infected computer. They can do
whatever they want such as sending, receiving, launching and deleting files, displaying data and
rebooting the endpoint.
 Rootkit: These are designed to hide certain objects or activities in your system. This can
effectively prevent malicious programs being detected.
 Trojan-Banker: Its purpose is to steal your account data for online banking systems, e-
payment systems and credit or debit cards.
 Trojan-Downloader: Trojan-Downloaders can download and install new versions of malicious
programs onto your computer – including Trojans and adware.
 Trojan-Dropper: This is used to install Trojans and other viruses into the computer. This can
also conceal detection of malicious programs. If you're using a weak or outdated antivirus,
some of them can't scan all of the components inside this type of Trojan horse virus.
 Spyware: Spyware is malware designed to spy on you. It hides in the background and takes
notes on what you do online, including your passwords, credit card numbers, surfing habits, and
more.
 Ransomware: This kind of malware typically locks down your computer and your files, and
threatens to erase everything unless you pay a ransom.
 Adware: Though not always malicious in nature, aggressive advertising software can
undermine your security just to serve you ads — which can give other malware an easy way in.
Plus, let’s face it: pop-ups are really annoying.
 Botnets: Botnets are networks of infected computers that are made to work together under the
control of an attacker.
b. Method Of Spread Of Malware
 Email: When you read emails malware spread through attachments, so it is always better to scan
them prior to downloading.
 Web: There are many sites, which are infested with different malwares and these enter your
computer when you visit them.
 Direct (USB, SD-Card, etc): USB sticks are another common way by which malware attack and
spread in a system. Even systems in a computer lab might be infected with malware and when you
transfer files from an infected system to your system with USB stick, the infection enters your
system as well.
c. Methods to fight Against Malware
 Keep your software up to date: Software makers like Microsoft and Oracle routinely update their
software to fix bugs that could potentially be exploited by hackers. Oracle just released on Sunday
an update to its Java software to fix a security hole hackers could have used to infect computers
with malware.
 Don’t click on links within emails: A good rule of thumb is if you don’t recognize a sender of an
email, don’t click on any links within it. Microsoft says 44.8 percent of Windows virus infections
happen because the computer user clicked on something.
 Use free antivirus software: You don’t have to pay for software to protect your computer or for
an annual subscription to maintain the latest virus protection. For Windows users, Microsoft
Security Essentials is free. Avast is another free anti-virus program.
 Back up your computer: Do you regularly back up the information on your computer? If you
don’t – and 29 percent of computer users fall into that category – you have no protection from
calamites ranging from hard drive failure to your house burning down. If you value your data,
back it up.
 FIREWALL
Firewall introduction
 what is a firewall?
 What do firewalls do?
 Firewall benefits,

Firewall types
 Packet filtering
 SPI(stateful packet inspection)
 Proxy
 Software firewalls
 hardware firewalls
 blade based firewalls
 personal firewalls
 which firewall should you use?
 Configuring a simple firewall.

Packet filtering firewalls

 Things to filter in the IP header
 stateless vs. stateful filtering.
 ACLs.
 Advantages of packet filtering.
 Configuring packet filtering firewalls.

Stateful packet filtering

 Stateful algorithms
 packet by packet inspection
 application content filtering
 special handling (fragments, IP options),
 sessions with TCP and UDP.
 Firewall hacking detection: SYN attacks, SSL, SSH interception.
 Stateful packet inspection firewalls.
Proxy firewalls
 Circuit level
 application level,
 SOCKS.
 Proxy firewall advantages and disadvantages.
 Proxy firewalls.

Personal firewalls

 The role of personal firewalls,

 Windows XP,
 Zonealarm.
 Configuring a personal firewall.

Firewall architectures

 Home based,
 small office,
 enterprise,
 service provider,
 what is a DMZ?
 DMZ architectures,
 bastion hosts,
 multi DMZ.
 Virtual firewalls,
 transparent firewalls.
 Dual firewall design,
 high availability,
 load balancing, VRRP.
 Resilient firewall architecture.

Securing communications

 VPNs,
 IPsec.
  Firewall configuration of VPNs,
 integration of dedicated VPN devices and firewalls.
 IPSec VPN configuration.

Testing firewalls

 Configuration checklist,
 testing procedure,
 monitoring firewalls,
 logging, syslog.
 Testing firewalls.
CHAPTER 4: INTERNET PROTOCOL SECURITY (SSH, SSL, IPsec)

CONTENT

1. VPN
2. SSH
3. TLS/SSL
4. IPsec

1. VPN (Virtual Private Network)

A Virtual Private Network, or VPN, is exactly what it sounds like – a network with no physical
location that is configured to protect a user’s privacy online. Various types of VPN exist namely:

Remote access VPN

Remote access clients connect to a VPN gateway server on the organization's network. The gateway
requires the device to authenticate its identity before granting access to internal network resources. This
type usually relies on either IP Security (IPsec) or Secure Sockets Layer (SSL) to secure the connection.

Site-to-site VPN

In contrast, a site-to-site VPN uses a gateway device to connect an entire network in one location to a
network in another location. End-node devices in the remote location do not need VPN clients because
the gateway handles the connection. Most site-to-site VPNs connecting over the internet use IPsec. It is
also common for them to use carrier MPLS clouds rather than the public internet as the transport for site-
to-site VPNs. Here, too, it is possible to have either Layer 3 connectivity (MPLS IP VPN) or Layer 2
(virtual private LAN service) running across the base transport.

Mobile VPN

In a mobile VPN, the server still sits at the edge of the company network, enabling secure tunneled access
by authenticated, authorized clients. Mobile VPN tunnels are not tied to physical IP addresses, however.
Instead, each tunnel is bound to a logical IP address. That logical IP address sticks to the mobile device
no matter where it may roam. An effective mobile VPN provides continuous service to users, and can
switch across access technologies and multiple public and private networks.

Hardware VPN
Hardware VPNs offer a number of advantages over strictly software-based. In addition to enhanced
security, hardware VPNs can provide load balancing for large client loads. Administration is managed
through a Web browser interface. A hardware VPN is more expensive than software-based. Because of
the cost, hardware VPNs are more viable for larger businesses. Several vendors, including Irish vendor
InvizBox, offer devices that can function as hardware VPNs.

VPN appliance

A VPN appliance, also known as a VPN gateway appliance, is a network device with enhanced security
features. Also known as an SSL (Secure Sockets Layer) VPN appliance, it is a router that provides
protection, authorization, authentication and encryption for VPNs.

Dynamic multipoint virtual private network (DMVPN)

A dynamic multipoint virtual private network (DMVPN) exchanges data between sites without needing
to pass through an organization's headquarter VPN server or router. A DMVPN creates a mesh VPN
service that runs on VPN routers and firewall concentrators. Each remote site has a router configured to
connect to the company’s headquarters device (hub), providing access to the resources available. When
two spokes are required to exchange data between each other -- for a VoIP telephone call, for example -
- the spoke will contact the hub, obtain the needed information about the other end, and create a dynamic
IPsec VPN tunnel directly between them.

VPN Reconnect

VPN Reconnect is a feature of Windows 7 and Windows Server 2008 R2 that allows a virtual private
network connection to remain open during a brief lapse of Internet service. Usually, when a computing
device using a VPN connection drops its Internet connection, the end user has to manually reconnect.
Reconnect keeps the tunnel open for a configurable amount of time. So, when Internet service is restored,
the VPN connection is automatically restored as well. The feature was designed to improve usability for
mobile employees.

Security limitations of a virtual private network explained

Any device that accesses an isolated network through a VPN presents a risk of bringing malware to that
network environment. That is, unless there’s a requirement in the VPN connection process to assess the
state of the connecting device. Without an inspection to determine whether the connecting device
complies with an organization's security policies, attackers with stolen credentials can access network
resources, including switches and routers.

Security experts recommend that network administrators consider adding software-defined perimeter
(SDP) components to their VPN protection infrastructure in order to reduce potential attack surfaces. The
addition of SDP programming gives medium and large organizations the ability to use a zero trust
model for access to both on-premises and cloud network environments.

VPN Kill Switches

A kill switch is a last-resort security feature in some VPN products. If the VPN connection is disrupted,
the kill switch will automatically disconnect the device from the internet. This way, there is no chance
of IP address exposure.

There are two types of kill switches:

 Active kill switch protocols prevent devices from connecting to unsafe networks when the device is
connected to the VPN. Apart from server disruptions, it is disabled when not connected to the VPN.

 Passive kill switch protocols are more secure. They keep the device from connecting to non-VPN
connections even while disconnected from the VPN server.

2. SSH
SSH is the least similar between the three. It does provide the same level of protection as
SSL/TLS and IPsec but we can consider it specific to a type of service (access to remote shells).
Secure shell (SSH) is the replacement for various shell based protocols such as telnet, and other remote
logins as well as file transfer protocols such as FTP and remote file copy protocols such as RCP. The
deficiency with these protocols is that when you authenticate yourself to a server, it is always sent in the
clear. An eavesdropper can easily intercept these requests and masquerade as a potential user. Also, all
subsequent data that is transmitted is also in plaintext. If telnet is being used to access a corporate
machine, it could potentially store sensitive material that could fall into the hands of an intruder.
Corporations must disable telnet, ftp, and remote login services and replace them with the secured
versions SSH, SFTP and SCP. This is usually performed as part of the OS hardening guidelines before
product deployment.

Characteristics

 An application layer solution. It is a connection-oriented service and thus uses TCP ONLY. SSH
is primarily used for shell based solutions and ideally won’t be used to protect web browsing
sessions and other application services (though it can via port forwarding)

 Uses public key cryptography to prove the authenticity of the remote user. SSH can generate an
RSA key pair (it is believe Diffie-Hellman can also be used). It uses what’s known as a
fingerprint which is a snapshot of an individual host’s actual public key (for instance the
RSA public portion). The fingerprints are usually 128 bits in length. It is what the user can use
to verify that a public key is that of an individual or host. SSH will maintain a list of trusted
hosts. The actual data communication is secured using symmetric cryptography such as AES or
3DES, IDEA

 The public portion of the key is transmitted to the remote endpoint/server via an out-of-band
mechanism. Also a lack of key management

 SSH does provide some extensible features. Two of these are port forwarding and secure
tunneling. With port forwarding, you can tell the SSH daemon to listen to data communication
on a particular port and forward this communication to the encrypted SSH session. This allows
you to protect other services as well. In Linux, X11 forwarding takes advantage of this. X11 is
used for graphical display of a remote system on your localhost. With port forwarding, SSH can
be used to provide an encrypted session for X11

When to use
For shell access and file transfer, SSH is the simplest, most widely deployed and preferred secure
solution.

TLS and IPsec

These two security protocols provide very similar functionality but at different layers at the IP stack
layer. There are a lot of differences between the two protocols and some key reasons why certain
solutions prefer one over the other. For instance, in 3GPP (3G Wireless), IMS defines both of these
protocols for the secure signaling between User Equipments (end devices) and edge device proxies.

3. TLS
Transport Layer Security (TLS – RFC 2246) is based on SSLv3. It is a Layer 4 protocol as it runs directly
on top of TCP ONLY. It uses PKI to provide user authentication as well as symmetric keying for
confidentiality protection. It is designed to prevent eavesdropping, tampering, and message forgery. TLS
can be used in two methods:

 Mutual Authentication: User Equipment and server both provide certificates when establishing
a session. The server must validate the UE certificate, and the UE must validate the server
certificate. Mutual authentication provides a high degree of security however is computationally
extremely expensive due to the fact that it is public key cryptography. In a secure web browsing
session, this would be equivalent to both the user and the server authenticating themselves (which
doesn’t happen today)

 Server-Side Authentication: Only the server provides a certificate when establishing a session.
This is the common solution we see today with using secure web sessions between a user and a
web server (HTTPS request). This approach avoids the extra computational overhead of a PKI
operation on the User Equipment. It provides a medium level of security, with lower CPU
requirements on the UE. Also, the User is not mandated to own a valid certificate

Advantages

 TLS is the recommended security mechanism specified in RFC 3261 by the IETF. This is the
Session Initiation Protocol (SIP) used for the call establishment of Voice over IP

 SSL is used to secure http sessions (HTTPS)

 There is a general shift now towards the use of TCP to better handle longer messages

 TLS supports NAT traversal at the protocol layer while IPsec doesn’t

 TLS is implemented at the application level instead of the kernel level, which provides some
advantages such as easier support in multiple environments

 May be used to secure HTTP Digest sessions in SIP environments.

 In VoIP, More SIP devices such as phones and soft clients support TLS and not IPsec
  Provides privacy (private user identity)

 Provides user authentication instead of data-origin authentication (higher degree of

authentication)

 Preferred in e-commerce solutions such as online banking

 A push towards using SSL based VPNs as they are easier to deploy since it’s deployed via a
browser and doesn’t require specialized client software. They also provide more granular controls
as applications can restrict particular users based on a service

 Becoming the de facto standard for WPA2 wireless security authentication (EAP-TLS)

Disadvantages

 Both of the TLS models require the server and client to support PKI features, such as certificate
validation and certificate management. Not all clients and solutions support PKI. PKI is typically
used in complex environments

 PKI is computationally expensive since it uses public key cryptography

 TCP and TLS pose significant memory consumption and scaling issues when you have tens of
thousands of TCP connections. UDP and IPsec are easier to scale. TCP is not well liked by service
providers since the overheads associated with its mass use are significant compared to UDP.

 Runs on top of TCP only (connection-oriented). There is a subset version of TLS that is supported
for use with UDP called DTLS (RFC 4347)
  Provides only hop-by-hop security. What this means is that every intermittent hop would need to
be secured with TLS. With this, it doesn’t provide true end-2-end security

 TLS cannot be used to secure VoIP RTP media streams

 In Server-Side Authentication, only one end is authenticated

 TLS does not handle dead office recovery scenarios efficiently. As mentioned, PKI is CPU
intensive therefore when you need to handle re-authentications for all endpoints, this is going to
significantly slow down your system

When to use
Every web browser now has the SSL protocol built into it. There is no configuration required to utilize
it. Therefore to use a secure HTTP session or an SSL VPN requires no additional client software to
install. Ease of use with little maintenance required is what makes TLS/SSL extremely popular. As
mentioned above, one of the benefits of an SSL VPN is that it allows for granular controls. If we
wanted to provide a VPN for a particular application and not the entire network, we can achieve this
using an SSL VPN. This is why SSL VPNs are becoming more and more popular. You will see
TLS used more frequently when its use is tied to an individual instead of a device
The real bottleneck with TLS/SSL is the requirement for PKI. In environments where we can tolerate a
slower session, require user authentication and non-repudiation (such as online banking), TLS is the
choice.
people are skeptical about the deployment in VoIP and Wireless networks. Would you as a user, pay
extra money for your monthly service and tolerate slower registration times when you power on your
phone so you can have a secure authentication? there is high doubt on it. People still tend to talk freely
and are oblivious to those around them. The majority of Social Engineering attacks occur because
eavesdroppers are standing next to people and can interpret the conversation. Users always want the
cheapest solution and service providers know this. Even if identity theft or fraud occurs, the cost of
the risk and exposure doesn’t outweigh the cost to implement the appropriate safeguards. It’s much
cheaper to simply accept the risk.

4. IPsec
IPsec (RFCs 2401, 2406, 2409, 2411); is a protocol suite that runs at the networking layer (L3). It
provides confidentiality, integrity protection, data origin authentication and replay protection of each
message by encrypting and signing every message. IPsec is combination of many RFCs and defines two
main protocols to use: Authentication Header (AH) and Encapsulating Security Payload (ESP). ESP is
the preferred choice as it provides both authentication and confidentiality while AH doesn’t provide
confidentiality protection. In order to establish an IPsec Security Association (SA) between two
endpoints, the SAs need to be dynamically established via a key management protocol. This is normally
done via IKEv1/IKEv2 in the internet world however for 3GPP access security, they mandate an
alternative key management: IMS-AKA(outside the scope of this post)
Advantages

 Doesn’t mandate PKI (pre-shared key can be used instead)

 Since it runs at L3, will protect any transport or application on top of L3. This would allow us to
secure both any transport protocol or any application (i.e. it’s application independent)

 Transparent to applications as it’s integrated into the kernel

 Mandated by 3GPP for 3G Wireless networks to secure the access side connection and for
network domain security (NDS). NDS is used in both inter and intra domain networks

 Supports multiple modes (transport or tunnel). Transport mode is used for secure sessions
between end devices where tunnel mode is used between security gateways. Tunnel mode adds
an extra layer of security as both the header and payload are encrypted (in transport mode, only
the payload is encrypted)

 In 3GPP network IPsec presents no problem because there are no NAPT devices between the
phone and the server

 Since keying information is preloaded onto ISIM in 3GPP, setup time for IPsec SA’s is not
computationally expensive

 Transparent enough that it can be used with many key management protocols (manual keying,
IKEv1, IKEv2, IMS-AKA)

 Most VPNs use IPsec

  Can be used with Kerberos

Disadvantages

 In IETF, TLS is preferred to IPsec

 IPsec is not NA(P)T friendly. When a NAPT device encounters an IPsec ESP packet it no longer
has access to the L4 ports since it’s encrypted as part of the L3 payload and will usually revert to
NAT-only operation (translate only the IP header and not the ports). This has been solved by
using NAT-T and UDP Encapsulation as defined in RFCs 3948 and 3947. The ESP packet is
encapsulated within a UDP header (usually communicates on UDP port 4500)

 UDP NA(P)T bindings will timeout in one minute or so (no standard timeout). This means that
the clients need to send a datagram typically every 30th – 40th second to refresh the NA(P)T
binding, which of course increases the amount of traffic significantly

 UDP cannot handle fragmentation, so it is unsuitable for big datagrams

 No dead peer detection support. No way of knowing if you’ve lost connectivity to your peer since
UDP is stateless (see RFC 3706. Periodic keepalive heart beats are sent between peers)

 Not widely used in SIP Security

 Since it’s embedded within the IP stack, it would require kernel level changes

 At best, provides data-origin authentication. This is network to network authentication. You

aren’t authenticating a particular user but anyone that could be using that device

 With an IPsec VPN, it doesn’t allow for application filtering. You have access to the full network
(i.e. you are part of the corporate network)
  Both devices must be configured to talk to each other and require the use of third party hardware
and software

 Configuring IPsec and IKE is complex and cumbersome

When to use
IPsec VPNs are still the most widely used, especially for larger corporations. The computer connecting
via an IPsec VPN is now part of the corporate network and has the exact same access as if he was at his
office. Whenever need arises to connect remotely to work from either home or traveling, we can use
an IPsec VPN to connect.
You will see IPsec used more for secure communication between devices (such as proxy servers, security
gateways, edge routers) than any other network protocol. Since we don’t require user authentication in
these instances, data-origin authentication is sufficient.
In 3GPP networks, IPsec was chosen over TLS for several reasons, primarily though that it doesn’t
require PKI to implement and thus doesn’t require the computation overhead. IPsec is also more versatile
since it can secure TCP, UDP and SCTP