SSL Flashcards
If you manage hundreds of server farms, how do you maintain the security and encryption of data going through the network?
SSL Accelerators
Asymmetric encryption is hard and requires large cpu usage.
SSL Handshake?
SSL requires symmetric encryption between browser and server but asymmetric encryption to secure the connection thus SSL Handshake.
SSL Offload
SSL A offloads the process to a separate device instead of using the server; known as SSL Offloading/ SSL termination.
Comms what are encrypted may end at the offloading device and traffic beyond that point may be sent in the clear.
SSL Decryption
Decrypt information, examine for malicious payload then re-encrypt it and send it on its way. Decryption occurs by your browser having trust between the browser and third party site. Without that trust there would be no decryption. All starts with the browser: Browser has a list of trusted CA’s. Browser doesn’t trust a website unless a CA has signed a web server’s encryption certificate; The website pays money to the CA for this.
CA performs checks making sure the certificate goes to the appropriate person, it also carries out checks such as validation against the DNS Record or a phone call.
Browser checks the web server’s certificates, if its signed by a CA, encryption works!
SSL Proxy
In order to decrypt the information going to the third party website, you are going to have to perform a proxy function. Done via FW or proxy. User sends request to proxy, proxy performs url filtering. Proxy intercepts and acts as the sender, sends request to the website.
Carries out SSL handshake. Website responds with its cert. Proxy checks sites certificate with external CA, marked ok. Proxy creates a GET request to website, website responds with here I am|200 OK|.
Proxy resigns website with its own self certificate so the host can recognise and trust it. Proxy re-encrypts with key. Sends website to host. LOOK AT PHOTO 28/01/2020.
Hardware security module
Cryptographic hardware, back up keys and keep them secure, can act as an ssl endpoint.
Media gateway - look into this again
Converts between PTSN and VoIP. ISDN one side, Ethernet other side. If someone gains access to this device, they can disable all comms. DoS.
Can make outbound malicious/spam calls or listen into corp communications.
