1

There are 2 sets of API each hosted in 2 different organisations: my client's organisation and her partner's organisation. The servers from the 2 organisations communicate between each other through the APIs hosted in each organisations.

The APIs are already using HTTPS protocol and authenticated using an API key. For my client's case, her servers are on AWS and I have a firewall to only accept her partner's IP.

Since the APIs are already using HTTPS, I would assume that the data transmitted are already encrypted. However, my client has requested that I use an IPsec VPN between the servers.

I'm not sure if I'm missing something here. Since the data transmitted between my client's server and her partner's server through the APIs are already encrypted through HTTPS, is having IPsec still necessary?

Improve this question
2

1 Answer 1

Reset to default
2

Not for confidentiality, but possibly for access control. Servers that don't need to be publicly accessible are often placed "behind a VPN". This way, they are only reachable by authorised parties.

Whether this improves security is not always clear. A VPN can also have vulnerabilities, so replacing your API authentication endpoint with a VPN authentication endpoint does not seem to make much of a difference.

Perhaps client certificates or IP whitelisting is more suitable in your case.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .