What security protocols provide point-to-point confidentiality?

Question

Am I right in thinking that VPN doesn't protect until you're out onto the external network (assuming you're connecting from within an internal network)? Or does VPN provide confidentiality from the user's machine because the encryption is done using the client software?

Im trying to understand if I was on part of an internal network and I wanted to connect out, via an access point, what protocols would I have to use to ensure I had full point-to-point confidentiality? I thought I read somewhere that the VPN would not cover me across the Access Point and so the data would be visible to a network admin?

Sorry- so confused!

Answer 1

A VPN can connect machines or networks. Depending on what's being connected, it may or may not provide end-to-end confidentiality. There are three basic types of VPN: net-to-net, host-to-host, or host-to-net.

If your company has two offices, it might have a net-to-net VPN. Each office has a VPN gateway, and when you connect to a server on the other end, your traffic crosses your office network unencrypted, is encrypted at the VPN gateway, is protected across the Internet, is decrypted at the remote-office gateway, and crosses the remote-office network unencrypted. In this case there isn't end-to-end confidentiality; the traffic is unencrypted within the office networks.

On the other hand, two computers could both speak IPSEC, and could connect to each other in a host-to-host VPN. This would protect traffic across the entire network path. However, this is not a common configuration because lots of host-to-host VPN configurations require a lot of management.

The most common configuration is host-to-net. For example, you might use a VPN client on your computer at home to connect to a VPN gateway at your company's network. Traffic is encrypted leaving your host, but is decrypted by the VPN gateway and then crosses your office network unencrypted.

Answer 2

A VPN provides confidentiality from the VPN entry point to the VPN exit point. In typical enterprise scenarios where you're using a VPN on your laptop to connect to your enterprise network from a public or client network, the VPN keeps your data confidential between your laptop and the VPN server in your enterprise network; it doesn't do anything for the part between the VPN server and the site you're connecting to.

                         +-------------------------------------------------+
                         | enterprise network                              |
+--------+               |    +------------+       +--------------------+  |
| laptop |<==============|===>| VPN server |<----->| application server |  |
+--------+     VPN       |    +------------+       +--------------------+  |
                         |                                                 |
                         +-------------------------------------------------+

I can't tell from reading your question whether this is the scenario you're asking about. If you have an enterprise network with several physical locations and a shared VPN between them, then that VPN protects the communications between the VPN servers at both ends but not inside one location. Generally speaking, a VPN protects the communications only between the points on each side where the encryption is performed.

Note that the VPN only protects the traffic that goes through it. Depending on your configuration, DNS traffic may use the ambient network rather than the VPN; this can improve performance but it means that whoever can snoop on the host network can know which sites you're accessing (but not the data that you're exchanging with them).

The most common form of point-to-point confidentiality is SSL/TLS. An SSL connection keeps its data confidential between the client and the server (though it can sometimes leak information through timing). You'll usually see SSL in the form of HTTPS when connecting to websites, but it's also used to secure other applications such as IMAPS (IMAP over SSL), SMTPS (SMTP over SSL), …

All forms of point-to-point confidentiality assume that you're talking to the right server: it's no good having a secure connection if the guy at the other end is an attacker performing a man-in-the-middle attack. SSL rules out man-in-the-middle attacks through certificate verification, and its correct behavior depends on an operation that has to be performed by your browser for every site. Usually your VPN only connects to one end point and will be set up to reject such hijacking attempts from the start, so in this respect a VPN does provide a little extra security, but only at your end of the connection.

Answer 3

As gowenfawr has said, it depends on your VPN configuration. In most cases, connection in the same network is not secured. You'll need a host-to-host VPN, the easiest way is to create a ssh tunnel between the two computer without touching your company VPN, and your data are not visible under netadmin's eyes.