3

We've set up a client-server communication with a partner. We host the server and the partner is the client. The specifications for this communication have been provided by our partner.

The specifications are as follow:

  • TLS 1.2.
  • 1 way SSL, so that the client knows that data is provided by the expected server.
  • IP filtering, so that only authorized entities can access data stored on the server.

However, we also need to ensure that the entity retrieving the data is the authorized partner. So we are having some concerns about the reliability of the specifications provided.

Wouldn't a 2 way SSL + IP filtering be more appropriate in our case scenario ?

2
  • What are "1 way SSL" and "2 way SSL" in this context? Do you mean regular TLS vs. mutual auth with a client certificate? (fyi, SSL is the old deprecated protocol that is now called TLS) – Polynomial Feb 12 '18 at 16:20
  • @Polynomial You got my meaning right and your answer suits me :) To my understanding, mutual authentication = 2 way SSL. Thanks. – BS_C3 Feb 12 '18 at 17:01
4

Yes, mutual authentication using a client certificate is ideal here. IP filtering is a good control, but it should only really be used as a secondary security control.

As an example of how the IP filtering could fail here, assume that the client (it's a server but in this case it's the one initiating the TLS connection) is on a network that can route out to the internet in order to talk to the server. Now imagine that instead of attacking that client box, an attacker finds a way into a completely unrelated system on the same network, or even the router itself for that subnet. They can now talk to the remote server because they're routing out as the same external IP address.

With mutual authentication the client certificate is on the client system only, so the attacker cannot communicate with the remote server even if they break into the same network as the client.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.