1

I have been reading a certain article about SSL VPN and it got me thinking. Is it possible to integrate this technology in a banking server? can or does it support standalone mobile applications?

closed as unclear what you're asking by forest, Anders, Tom K., Peter Harmann, ISMSDEV May 2 '18 at 20:38

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • What article did you read? What purpose would the VPN serve? – AndrolGenhald Apr 30 '18 at 16:41
  • @AndrolGenhald [searchsecurity.techtarget.com/definition/SSL-VPN] well provide advanced hidden security i guess... – Timothy Mach Apr 30 '18 at 16:44
  • 3
    @TimothyMach: I don't really understand your question. Isn't your idea of integrating a SSL VPN into the banking application essentially using SSL to communicate between mobile application and server, i.e. what is already the standard except that it is not called a SSL-VPN but just SSL/TLS connection or HTTPS connection? – Steffen Ullrich Apr 30 '18 at 17:01
  • @SteffenUllrich wait, meaning SSL/TLS contains or is a VPN of some sort? i thought a vpn is for "hiding" or providing privacy and encryption especially in web servers. so my question is, does it work in a similar way in mobile standalone applications – Timothy Mach Apr 30 '18 at 19:32
  • @TimothyMach: TLS (or SSL or SSL/TLS) provides an encrypted tunnel at the application level, for example to secure access to a web site. A VPN usually provides an encrypted tunnel to not only a single site but to a whole network. There are various types of VPN and an SSL-VPN is using SSL for encryption. Since you only want to have an encrypted tunnel between a mobile client and a banking server you don't need a protected access to a full network but only protected access to a specific application running on the server - which is usually done with plain SSL or with HTTPS (HTTP over SSL). – Steffen Ullrich Apr 30 '18 at 19:39
0

To summarize the discussion in the comments:

  • SSL/TLS is an established technology to provide communication well protected against sniffing and modification. It is used most prominently as the security layer in HTTPS, i.e. to securely access web sites. But it is also to secure mail delivery and more.
  • A VPN is used to securely connect to a different network. SSL-VPN's are using SSL/TLS as the underlying protocol to provide the necessary security, similar to HTTPS using SSL/TLS as the underlying protocol.
  • In case of connecting a mobile banking app to a server using a SSL/TLS connection (often with HTTP on top, i.e. HTTPS) is the common way to provide the needed protection for data exchange.
  • While in theory one could also use a SSL-VPN in this case this would not provide any benefits since only the connection between mobile app and the server application need to be secured and not between the mobile app and the whole banking network. In other words: the protection by SSL/TLS is needed but only as a connection between two application and not in form of a VPN. Moreover, using a SSL-VPN instead of a simple SSL/TLS connection would add useless complexity which actually might decrease the security instead of increasing it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.