WEBVTT

00:00:01.040 --> 00:00:06.380
Another system that we will look into is the Internet Protocol Security,

00:00:06.380 --> 00:00:08.060
or IPsec, VPN.

00:00:08.060 --> 00:00:13.850
A quick note to make is that if you're implementing zero trust architecture,

00:00:13.860 --> 00:00:20.450
your focus is not on the perimeterization and the boundaries of yesteryear.

00:00:20.540 --> 00:00:27.460
What that means is that you will probably be eliminating the need for VPNs

00:00:27.540 --> 00:00:31.500
as you are concentrating on specific protect surfaces.

00:00:31.620 --> 00:00:37.290
But IPsec is still heavily in use, so we should know how it operates.

00:00:37.550 --> 00:00:43.370
IPsec has these primary components for engaging an IPsec

00:00:43.370 --> 00:00:45.860
tunnel: The Authentication Header,

00:00:45.940 --> 00:00:50.750
which is used to verify the identity of the endpoint

00:00:50.750 --> 00:00:52.150
that you're communicating with,

00:00:52.240 --> 00:00:56.950
and Encapsulating Security Payload that allows you to have full

00:00:56.950 --> 00:01:00.870
confidentiality of the whole payload along with integrity.

00:01:00.870 --> 00:01:05.470
When looking at the Encapsulating Security Payload,

00:01:05.470 --> 00:01:09.790
the ESP header contains information showing which security

00:01:09.790 --> 00:01:13.360
association to use and the packet sequence number.

00:01:13.840 --> 00:01:18.340
The ESP payload contains the encrypted part of the packet,

00:01:18.350 --> 00:01:22.040
which if the algorithm requires an initialization vector,

00:01:22.050 --> 00:01:24.020
it will be included with that payload.

00:01:24.130 --> 00:01:27.440
The endpoints negotiate which encryption to use when the

00:01:27.440 --> 00:01:29.860
security association is established.

00:01:30.320 --> 00:01:34.140
The ESP trailer can include padding, filler bytes,

00:01:34.140 --> 00:01:36.390
if required by the encryption algorithm,

00:01:36.400 --> 00:01:38.250
or to help align fields.

00:01:38.250 --> 00:01:43.260
And then ESP also has its form of authentication.

00:01:43.940 --> 00:01:49.030
Another element of IPsec would include the security association. A

00:01:49.030 --> 00:01:52.880
security association defines the mechanisms that an endpoint will

00:01:52.880 --> 00:01:54.670
use to communicate with its partner.

00:01:54.680 --> 00:02:00.980
All SAs cover transmission in one direction. You also have an Internet

00:02:00.990 --> 00:02:05.840
Key Exchange capability, which enables the exchange of cryptographic

00:02:05.850 --> 00:02:10.389
information. When we're using IKE, this allows for communication

00:02:10.389 --> 00:02:14.940
partners to prove their identity to each other and establish a secure

00:02:14.940 --> 00:02:21.060
channel applied by means of some kind of shared secret or a public key

00:02:21.060 --> 00:02:21.970
capability.

00:02:22.140 --> 00:02:28.230
When you choose whether you will use tunnel or transport mode, this is the

00:02:28.230 --> 00:02:33.250
separation between link encryption and end‑to‑end encryption,

00:02:33.400 --> 00:02:34.350
respectively.

00:02:34.360 --> 00:02:37.760
Let's take a look at what the process flow might look like.

00:02:38.740 --> 00:02:42.180
You have two individuals who are wanting to communicate with each other

00:02:42.190 --> 00:02:46.870
who have very little confidence about the security between network A and

00:02:46.870 --> 00:02:51.880
network B, so they could choose to do what's called link encryption, or

00:02:51.880 --> 00:02:54.570
tunnel mode, inside of IPsec.

00:02:54.620 --> 00:02:59.440
But what if their situation changed and the user who has the

00:02:59.440 --> 00:03:04.120
designation of top secret, Breonna, finds out that there are now other

00:03:04.120 --> 00:03:06.970
users on the network that have a lower clearance.

00:03:06.980 --> 00:03:10.670
Well, then they might want to do what's known as end‑to‑end

00:03:10.680 --> 00:03:13.610
encryption, and that would be transport mode.