SSL VPNs pose network security risks
The use of secure sockets layer (SSL) virtual private networks (VPNs) opens up networks to security risks, according to a white paper by NCP Engineering.
The NCP white paper – Debunking the Myths of SSL VPN Security - warns that vulnerabilities are endemic is SSL to the point where banks have their customer data stolen at “an alarming rate" and "web application developers create a false sense of security by trusting the confidence and credibility of a protocol that is likely to fail them before they can get through a single development cycle.”
Many of the attack vectors used against SSL are from other technologies using SSL or that SSL makes use of, such as block ciphers, stream ciphers, document format, and authentication and authorization schemes, according to the white paper. The white paper exposes what it terms “myths” about SSL VPN. One myth is that SSL VPN is clientless. It warns that clientless SSL VPN products from multiple vendors can enable an attacker to use these devices to bypass authentication or conduct other web-based attacks.
