Virtual Private Network (VPN) Interview Questions and Answers

1 :: Can you list some items for a VPN checklist from deciding whether to use, then selecting, then deploying, then maintaining VPN?

Well, IPSEC — real IPSEC as it exists today — is still morphing, but not so much that one shouldn't require it as a basis for a VPN. So we might have:

► IPSEC compliant (including ISAKMP/Oakley)
► Interoperability with other IPSEC compliant vendors
► Strong encryption, long key length
► If the VPN solution is not part of the firewall, which is fine, will it work with the firewall?
► Does the VPN product work both with and without trust? (Remember, it requires working closely with the firewall.)
► For an "add on" VPN, does it work in conjunction with the firewall, or does it simply circumvent the firewall? (I'm not suggesting one way is good and the other bad, but it may be something the security manager cares about, and the answer should be known.)
► Does the VPN support automatic creation of user-level VPNs (for mobile users)? In a very large organization, the system manager probably would rather not have to manually create VPN accounts for every user.
► Has the VPN been certified by a recognized organization? (The ICSA has a certification and testing process for VPNs. Others probably exist as well.)

5/5 Rating (1 vote)

Is This Answer Correct?    0 Yes 0 No

2 :: What kind of policies and procedures need to be developed for VPN?

If we are imaging an IPSEC world, where eventually the majority of gateways we might connect to supports IPSEC, things become both easy and interesting. If we have a mechanism that can invite encryption use, respond to such invitations, but also talk without encryption if required, we need to think about things such as:

► What risk are we under from eavesdroppers?
► Do we always want to talk encrypted if we can?
► What are the list of sites or networks with whom we must talk encrypted?
► If we cannot talk encrypted to those "must encrypt" sites, what do you want the fall back to be?
► What if we're invited to talk encrypted, but using weak crypto (answer this question both for the general case as well as for the "must encrypt" set of networks)?
► How often do we change session keys?
► Do we need the ability to recover data or keys for encrypted sessions? (I'm arguing that this is almost a 100% "yes" if we were talking about file encryption, but almost 100% "no" for network communications.)
► Are we going to have the encryption be certificate-based? Who do we trust to be a Certification Authority?
► Will we allow encryption through the firewall or only up to the firewall?
► How do we protect the keys? Who has access to the keys?

5/5 Rating (1 vote)

Is This Answer Correct?    0 Yes 0 No

3 :: What are unreasonable expectations for VPN?

With firewalls, we went from a very small number of security-wise companies using real firewalls to firewalls becoming a "must have" on a checklist. But somehow, having a firewall became synonymous with "all my Internet security problems are solved!" VPNs and IPSEC have started off that way too. There has been a lot of "When we have IPSEC on the desk top we won't need firewalls." This is nonsense. VPNs cannot enforce security policies, they cannot detect misuse or mistakes, and they cannot regulate access. VPNs can do what they were meant to do: keep communications private.

5/5 Rating (1 vote)

Is This Answer Correct?    0 Yes 0 No

4 :: What are reasonable expectations for a VPN?

Privacy from end to end. The cryptography used, generally speaking, is very good. Whatever you do, that is encrypted, is very well hidden from sniffers on the net. Whatever is not encrypted, you may as well shout from the rooftops or post on your web page.

5/5 Rating (1 vote)

Is This Answer Correct?    0 Yes 0 No

5 :: What kind of resources (staff, computational muscle, bandwidth, etc.) are required for VPN deployment, usage, maintenance?

VPNs are typically handled as just another job by the network or system administrator staff. Whoever is managing the firewall today can easily add VPN management to the plate because once a VPN is set up there is little else to do on most implementations.

5/5 Rating (1 vote)

Is This Answer Correct?    0 Yes 0 No