SSL VPN : Understanding, Evaluating, and Planning Secure, Web-Based Remote Access

Virtual Private Networks (VPNs) provide remote workers with secure access to their company network via the internet by encrypting all data sent between the company network and the user’s machine (the client). Before SSL VPN this typically required the client machine to have special software installed, or at least be specially configured for the purpose.

Clientless SSL VPNs avoid the need for client machines to be specially configured. Any computer with a Web browser can access SSL VPN systems. This has several benefits:

• Low admin costs, no remote configuration
• Users can safely access the company network from any machine, be that a public workstation, a palmtop or mobile phone
• By pass ISP restrictions on custom VPNs by using standard technologies

SSL VPN is usually provided by a hardware appliance that forms part of the company network. These appliances act as gateways, providing internal services such as file shares, email servers, and applications in a web based format encrypted using SSL. Existing players and new entrants, such as Nokia, Netilla, Symantec, Whale Communications, and NetScreen technologies, are rushing our SSL VPN products to meet growing demand.

This book provides a detailed technical and business introduction to SSL VPN. It explains how SSL VPN devices work along with their benefits and pitfalls. As well as covering SSL VPN technologies, the book also looks at how to authenticate and educate users--a vital element in ensuring that the security of remote locations is not compromised. The book also looks at strategies for making legacy applications accessible via the SSL VPN.

About the Authors

Joseph Steinberg has been involved with computer networking and security since 1989. He has worked in technical positions at Citibank and AT&T and served in senior-management capacities at several product vendors and consulting firms. He has spent more than four years with Whale Communications, one of the pioneers of SSL VPN technology.

Mr. Steinberg's May 2003 article, SSL VPN Security, introduced an awareness of critical security issues created by SSL VPN technology; since its publication, nearly every SSL VPN vendor has acted upon the concerns and recommendations made in the article.

Mr. Steinberg earned an M.S. in Computer Science from NYU, and holds a CISSP (Certified Information Systems Security Professional) credential as well as advanced certifications in IT security management (ISSMP) and architecture (ISSAP). He has lectured on several topics related to IT security and management and has authored numerous articles that have appeared in various journals, magazines, and other publications. A recognized expert on IT security, he is also interviewed on a regular basis by media personalities and is a member of several panels discussing IT-security related matters.

Timothy Speed is an IBM-Certified IT Architect working for the IBM Lotus Brand (ISSL). Tim has been involved in Internet and messaging security since 1992. He also participated with the Domino infrastructure team at the Nagano Olympics and with the Lotus Notes systems for the Sydney Olympics. His certifications include CISSP, MCSE, A+ Plus Security from CompTIA, Lotus Domino CLP Principal Administrator, and Lotus Domino CLP Principal Developer. (Notes/Domino certifications in R3, R4, R5, and ND6)

Tim has also co-authored four books: The Internet Security Guidebook,The Personal Internet Security Guidebook, Enterprise Directory and Security Implementation Guide: Designing and Implementing Directories in Your Organization,and Internet Security: A Jumpstart for Systems Administrators and IT Managers.