INTERNATIONAL ISO/IEC STANDARD 18028-1

ISO/IEC18028-1:2006(E)• uncertainty about the authentication of users,— uncertainty about the security of the underlying service provider,— poor performance or availability of service,— non compliance with regulatory and legislative requirements on the use of encryption in certain countries.13.2.9.3 Security ControlsIn VPNs, cryptographic techniques are commonly used in networking and/or application protocols toimplement security functionality and services, especially if the network on which the VPN is built is a publicnetwork (for example, the Internet). In most implementations the communications links between theparticipants are encrypted to ensure confidentiality, and authentication protocols are used to verify the identityof the systems connected to the VPN. Typically, the encrypted information travels through a secure 'tunnel'that connects to an organization's gateway, with the confidentiality and integrity of the information maintained.The gateway then identifies the remote user and lets the user access only the information they are authorizedto receive.Thus, a VPN is a mechanism based on protocol tunneling - treatment of one complete protocol (the clientprotocol) as a simple stream of bits and wrapping it up in another (the carrier protocol). Normally, the VPNcarrier protocol provides security (confidentiality and integrity) to the client protocol(s). In considering the useof VPNs, the architectural aspects that should be addressed include:— endpoint security,— termination security,— malicious software protection,— authentication,— intrusion detection,— security gateways (including firewalls),— network design,— other connectivity,— split tunneling,— audit logging and network monitoring,— technical vulnerability management.Further detail on VPNs, including on each of these architectural aspects, is provided in ISO/IEC 18028-5.13.2.10 IP Convergence (data, voice, video)13.2.10.1 BackgroundAs voice and data convergence gains popularity, the security issues should be recognized and addressed.Although current telephony implementations require security controls to deter toll fraud and voice mail andother security breaches, these systems are not integrated into the corporate data network and are not subjectto the same risks as IP data networks. With the convergence of voice and data, security controls need to beimplemented to reduce the risk of attacks.A VoIP application typically consists of proprietary software hosted on open or commercially availablehardware and operating systems. The number of servers depends on vendor implementation as well as theactual deployment. These components communicate via IP over Ethernet and are interconnected via switchesand/ or routers.© ISO/IEC 2006 - All rights reserved 39