The Threats in SSL VPN and the Solutions
LI Zhi-tang,HE Ji-mei,LEI Jie
2006-01-01
Abstract:SSL VPN Applications present an exciting new development trend in remote-access technology. As they require no client-side software other than a Web browser, SSL VPN offers great convenience, and promises to provide a much lower Total Cost of Ownership than the traditional IPSEC VPN. Yet, at the same time, this novel technology presents new challenges in the realm of security. This paper explores the security issues in the SSL VPN client/server model, explains the threats inherent both on the client side and on the server side, such as “sensitive data remaining on insecure access devices”, “insecure logout”, “application-level vulnerabilities”, “authentication”, and so on. Finally, we discuss the technologies to address them.