Selecting and Hardening Remote Access VPN Solutions [pdf]
media.defense.gov
Selecting and Hardening Remote Access VPN Solutions [pdf]
1–10 of 41 posts
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#2A lot of warnings against TLS based VPN solutions.
I imagine these solutions are popular because they are more likely to function through corporate firewalls, where IPsec might be blocked.
Unsurprisingly no mention of wireguard, as it's not FIPS. However, unless you need FIPS compliance, it seems like the way to go these days.
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#3Strange how this implies that the end-all-be-all of VPNs is IPsec. I would've loved to hear their opinion on wireguard and this generation of mesh VPNs
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#4I'm saddened that the answer isn't "Just use BeyondCorp".
Layer 7 solutions provide so much more capacity for granular AuthZ, and thereby eliminate the "soft underbelly" of corporate networks.
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#5Strange how this implies that the end-all-be-all of VPNs is IPsec. I would've loved to hear their opinion on wireguard and this generation of mesh VPNs
That's because wireguard uses non FIPS 140 compliant algorithms. What would be really interesting is if the NSA told us their thoughts on the wireguard algos.
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#6Explore Happy And Healthy Relationship Tips To Be Happy In Life: https://www.hackerslist.co/explore-happy-and-healthy-relatio...
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#7FWIW, the NSA documents on recommended hardening approaches are usually pretty good. Their Cisco PDF many years ago was really good.
Anyone have a non-PDF version of this? :-p
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#8I'm saddened that the answer isn't "Just use BeyondCorp". Layer 7 solutions provide so much more capacity for granular AuthZ, and thereby eliminate the "soft underbelly" of corporate networks.
You're expecting the NSA to recommend BeyondCorp?
Re: Selecting and Hardening Remote Access VPN Solutions [pdf]
#9A lot of warnings against TLS based VPN solutions. I imagine these solutions are popular because they are more likely to function through corporate firewalls, where IPsec might be blocked. Unsurprisingly no mention of wireguard, as it's not FIPS. However, unless you need FIPS compliance, it seems like the way to go these days.
With something like OpenVPN, they seem to have strong issues with some exploitable parts of the startup/bring-up process. There are two ways to look at this:
It's either too good for them or it's bad. :)