4.2.3. Secure Communication and Access

💡 First Principle: Every communication channel is a potential interception point. Securing communication means encrypting data in transit, authenticating both endpoints, and controlling who can access management interfaces.

VPN types:

• Site-to-site VPN — connects two networks (e.g., headquarters to branch office) over an encrypted tunnel. Uses IPSec. Always-on, transparent to users.
• Remote access VPN — connects individual users to the corporate network. Uses IPSec or SSL/TLS. Initiated by the user when needed.
• Split tunnel vs. full tunnel — split tunnel only routes corporate traffic through the VPN (better performance, less security). Full tunnel routes ALL traffic through the VPN (more secure, slower). Full tunnel ensures all traffic is inspected by corporate security controls.

Secure protocols:

• SSH — encrypted remote administration (replaces Telnet)
• TLS/HTTPS — encrypted web communication
• SFTP/SCP — encrypted file transfer (replaces FTP)
• SNMPv3 — encrypted network management (replaces SNMPv1/v2)
• LDAPS — encrypted directory queries

Out-of-band management — managing network devices through a separate, dedicated management network that's isolated from production traffic. If the production network is compromised, the management channel remains accessible. Requires separate physical or logical infrastructure.

Jump server (bastion host) — a hardened intermediary that administrators connect through to reach internal systems. Instead of exposing management interfaces directly, all administrative access routes through the jump server. This creates a single, auditable choke point: every admin session is logged, and the jump server can enforce MFA, session recording, and time-limited access. If the jump server is compromised, you disable one system rather than re-securing every device.

Port security on switches restricts which devices can connect to physical ports by limiting allowed MAC addresses. Port security prevents rogue devices from connecting to the network — if an unauthorized MAC appears, the port can be configured to shut down, restrict traffic, or alert administrators.

⚠️ Exam Trap: Split tunnel is faster but less secure because non-corporate traffic bypasses VPN inspection. If a question describes a security concern about remote users accessing both corporate resources and the internet, full tunnel is the more secure answer.