Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm a bit confused with some different network security techniques.

Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be possible. What (good or bad) options do we have?

I'd say this:

  • IPsec: but wont get past the NAT
  • SSL/TLS: good I guess?
  • SSH: more designed toward remote shell commands?
  • Kerberos: better access control, but designed toward user management for multiple servers?
  • PKI with x.509 certificates: good I guess?
  • PGP: also good I guess?

I know some of these options are not comparable as they serve different purposes. But that is my question, what viable options are there for this particular case?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Establishing a Secure Connection

we want a secure communication with a particular mail server in a remote company network.

If you want to secure the connection to the server, either stick with VPN which could use IPSec (to get a secure connection to the company network, not secured between their VPN gateway and mail server) or SSL/TLS which secures the SMTP/IMAP connection itself.

SSL/TLS is probably a good choice as you cannot forget to enable VPN before connecting to the mail server(s) - or do not need to add mechanisms to prevent this.

If NAT is the problem, some VPN technologies can also pass network address translation.

The other protocols

You could also do with SSH-tunnels, but this probably includes more hassles.

The others are not offering any encryption capabilities themselves:

Kerberos is for authentication, not for encryption. PKI on X.509 certificates is for putting trust in certificates. Other protocols use these certificates for encryption (among other things), for example SSL.

OpenPGP encrypts the messages, not the connection. It depends on your needs whether this is a feasible alternative, but does not fit the requirements you posted (secure connection to the mail server). Especially, it only works with communication partners also using OpenPGP; all mail not send using OpenPGP will be transfered unencrypted to your client computer.


Of course you can combine these technologies. For example, you could use VPN for securing access to the company network (possibly some critical services aren't even available without) and use SSL anyway (lots of mail servers don't allow unencrypted connections anyway). Using OpenPGP gives you another level of security when emails leave your (secure) company network on unencrypted paths, and protect you from evil server administrators and black hat hackers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.