1 vs 2 way mutual SSL + IP filtering

Question

We've set up a client-server communication with a partner. We host the server and the partner is the client. The specifications for this communication have been provided by our partner.

The specifications are as follow:

• TLS 1.2.
• 1 way SSL, so that the client knows that data is provided by the expected server.
• IP filtering, so that only authorized entities can access data stored on the server.

However, we also need to ensure that the entity retrieving the data is the authorized partner. So we are having some concerns about the reliability of the specifications provided.

Wouldn't a 2 way SSL + IP filtering be more appropriate in our case scenario ?

Answer 1

Yes, mutual authentication using a client certificate is ideal here. IP filtering is a good control, but it should only really be used as a secondary security control.

As an example of how the IP filtering could fail here, assume that the client (it's a server but in this case it's the one initiating the TLS connection) is on a network that can route out to the internet in order to talk to the server. Now imagine that instead of attacking that client box, an attacker finds a way into a completely unrelated system on the same network, or even the router itself for that subnet. They can now talk to the remote server because they're routing out as the same external IP address.

With mutual authentication the client certificate is on the client system only, so the attacker cannot communicate with the remote server even if they break into the same network as the client.