Our bank is considering using a virtual private network (VPN) in the design of a WAN which will facilitate data communication between our branch offices.

Naturally, as compliance officer, I have a concern about the level of security of a VPN. I am also concerned about the position of the regulatory agencies with respect to the security of a VPN.

If anyone is currently using a VPN can you help me address these issues?

Outlook Web Access provides access to a Microsoft Exchange Server via a Web browser. It allows you do to most of what you can do using Outlook on your desktop from any desktop with a Net connection.

The challenge is that well-meaning systems administrators do wonderful things like hide Outlook Web Access behind the corporate firewall. This can either completely cut off access to OWA or simply make it anywhere from a little bit to really, really difficult.

Of course, Windows XP also gives you the tools--in the form of the Microsoft VPN client--to connect to Outlook through those firewalls. Assuming that the client works with your network's firewall, and that you remember your VPN's name, your user name and password, and some basic security precautions (make sure you delete the connection from whatever desktop you're using when you're done), this should work just fine.

A well-designed VPN uses several methods for keeping your connection and data secure:

Firewalls - A firewall provides a strong barrier between your private network and the Internet. You can set firewalls to restrict the number of open ports, what type of packets are passed through and which protocols are allowed through. Some VPN products, such as Cisco's 1700 routers, can be upgraded to include firewall capabilities by running the appropriate Cisco IOS on them. You should already have a good firewall in place before you implement a VPN, but a firewall can also be used to terminate the VPN sessions.

Encryption - This is the process of taking all the data that one computer is sending to another and encoding it into a form that only the other computer will be able to decode. Most computer encryption systems belong in one of two categories:
Symmetric-key encryption
Public-key encryption
In symmetric-key encryption, each computer has a secret key (code) that it can use to encrypt a packet of information before it is sent over the network to another computer. Symmetric-key requires that you know which computers will be talking to each other so you can install the key on each one. Symmetric-key encryption is essentially the same as a secret code that each of the two computers must know in order to decode the information. The code provides the key to decoding the message. Think of it like this: You create a coded message to send to a friend in which each letter is substituted with the letter that is two down from it in the alphabet. So "A" becomes "C," and "B" becomes "D". You have already told a trusted friend that the code is "Shift by 2". Your friend gets the message and decodes it. Anyone else who sees the message will see only nonsense.

Public-key encryption uses a combination of a private key and a public key. The private key is known only to your computer, while the public key is given by your computer to any computer that wants to communicate securely with it. To decode an encrypted message, a computer must use the public key, provided by the originating computer, and its own private key. A very popular public-key encryption utility is called Pretty Good Privacy (PGP), which allows you to encrypt almost anything. You can find out more about PGP at the PGP site.

IPSec - Internet Protocol Security Protocol (IPSec) provides enhanced security features such as better encryption algorithms and more comprehensive authentication. IPSec has two encryption modes: tunnel and transport. Tunnel encrypts the header and the payload of each packet while transport only encrypts the payload. Only systems that are IPSec compliant can take advantage of this protocol. Also, all devices must use a common key and the firewalls of each network must have very similar security policies set up. IPSec can encrypt data between various devices, such as:

Router-to-router
Firewall-to-router
PC-to-router
PC-to-server

AAA Server - AAA Servers (Authentication, Authorization and Accounting) are used for more secure access in a Remote-Access VPN environment. When a request to establish a session comes in from a dial-up client, the request is proxied to the AAA server. AAA then checks the following:
Who you are (Authentication)
What you are allowed to do (Authorization)
What you actually do (Accounting)
The Accounting information is especially useful for tracking client use for security auditing, billing or reporting purposes.