User manual NOKIA D211 RADIO CARD DATA SECURITY GUIDES FOR THE D211

[. . . ] DATA SECURITY Copyright © Nokia Corporation 2002. INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 REMOTE ACCESS ARCHITECTURES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. 1 2. 2 DIAL-UP MODEM ACCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [. . . ] Often the VPN clients and servers also include an embedded firewall. A so-called personal firewall 5/12 filters the incoming data and allows Internet connections only from the pre-defined hosts. This prevents a hostile attacker from accessing the remote terminal. Integrated encryption ensures that it is practically impossible for unauthorised parties to read data. Most VPN devices automatically negotiate the use of the strongest possible encryption and data-authentication algorithms between the communicating parties. The encryption is transparent for all applications, such as e-mail and Web browser, that use IP protocols. The only significant effect is that VPN encapsulation adds a little extra overhead data that has to be submitted over the wireless link. 2. 2. 3 Commercial VPN appliances There is a wide range of commercial VPN solutions on the market. A VPN security gateway may fit any of the following categories: high-performance VPN routers, firewalls, integrated VPN hardware, and inexpensive VPN software. Packet encryption is normally included in routers either as an add-on software or an additional circuit board. The latter is best for situations that require greater throughput. Combining tunnelling and encryption with firewalls is probably the best solution for small networks with low volumes of traffic. In most cases the corporate IT manager selects and administrates the VPN system. The main criterion for selecting the proper solution is the requested capacity, which in practice is the number of remote access users. Typically, the VPN has to make a conversion between the corporate network and the operator network IP addressing scheme. Therefore, it is recommended to select a solution that supports network address translation (NAT) traversal. The standardised interoperability between different VPN devices guarantees the interoperability of the VPN client and a number of VPN servers. The Nokia D211 is interoperability tested with leading VPN client and server products. A detailed list of the tested products can be found at: www. nokia. com. 2. 2. 4 Personal firewall Personal firewall is a software with a set of rules that allows and denies network traffic through a computer. It also monitors or controls applications in order to protect them against trojans and keyloggers. Primary use is to enhance security when a VPN client is used. A personal firewall controls access into the user's PC. When your laptop is used in an insecure network, the protection level should be configured to be very high. [. . . ] In the case of a public access zone or home wireless LAN, the user data is routed via the public Internet. From the security perspective, both of these require the usage of VPN. The same terminal security configuration can be used for both remote access and office access. Figure 5 shows the remote access architecture. [. . . ]