Another system that we will look into is the Internet Protocol Security,
or IPsec, VPN.
A quick note to make is that if you're implementing zero trust architecture,
your focus is not on the perimeterization and the boundaries of yesteryear.
What that means is that you will probably be eliminating the need for VPNs
as you are concentrating on specific protect surfaces.
But IPsec is still heavily in use, so we should know how it operates.
IPsec has these primary components for engaging an IPsec
tunnel: The Authentication Header,
which is used to verify the identity of the endpoint
that you're communicating with,
and Encapsulating Security Payload that allows you to have full
confidentiality of the whole payload along with integrity.
When looking at the Encapsulating Security Payload,
the ESP header contains information showing which security
association to use and the packet sequence number.
The ESP payload contains the encrypted part of the packet,
which if the algorithm requires an initialization vector,
it will be included with that payload.
The endpoints negotiate which encryption to use when the
security association is established.
The ESP trailer can include padding, filler bytes,
if required by the encryption algorithm,
or to help align fields.
And then ESP also has its form of authentication.
Another element of IPsec would include the security association. A
security association defines the mechanisms that an endpoint will
use to communicate with its partner.
All SAs cover transmission in one direction. You also have an Internet
Key Exchange capability, which enables the exchange of cryptographic
information. When we're using IKE, this allows for communication
partners to prove their identity to each other and establish a secure
channel applied by means of some kind of shared secret or a public key
capability.
When you choose whether you will use tunnel or transport mode, this is the
separation between link encryption and end‑to‑end encryption,
respectively.
Let's take a look at what the process flow might look like.
You have two individuals who are wanting to communicate with each other
who have very little confidence about the security between network A and
network B, so they could choose to do what's called link encryption, or
tunnel mode, inside of IPsec.
But what if their situation changed and the user who has the
designation of top secret, Breonna, finds out that there are now other
users on the network that have a lower clearance.
Well, then they might want to do what's known as end‑to‑end
encryption, and that would be transport mode.