Security Architecture · Topic 4 of 7
Secure Communication, Access and Identity
Security+ secure access: VPNs, tunneling, remote access, out of band management, secure file transfer, SSE, gMSAs and avoiding privilege creep.
- 5 min
- Tunneling wraps traffic inside another protocol, and a VPN is an encrypted tunnel.
- IPsec tunnel mode protects the whole packet and is typical for gateway to gateway links.
- A split tunnel sends only some traffic through the VPN.
What it is
This page covers how people and systems connect safely: virtual private networks (VPNs), tunnels, remote and out of band access, file transfer, encrypted messaging and cloud delivered security.
It also covers the identity side of access. Accounts for people and services should hold only the rights they need, and those rights should not grow quietly over time.
How it works
Virtual private networks and tunneling
Tunneling wraps one kind of traffic inside another so it can cross a network that would not carry it safely. A VPN is an encrypted tunnel across an untrusted network such as the internet.
| Shape | Use |
|---|---|
| Remote access VPN | One user connects to the company network |
| Site to site VPN | Two networks are linked, for example head office and branch |
Internet Protocol Security (IPsec) protects traffic at the network layer. It uses the Internet Key Exchange (IKE) to set up keys and the Encapsulating Security Payload (ESP) to encrypt data. A Transport Layer Security (TLS) VPN uses the same technology as secure web browsing and passes through most firewalls.
| IPsec mode | Description |
|---|---|
| Transport | Protects the payload and keeps the original IP header, used host to host |
| Tunnel | Wraps the whole original packet in a new one, used between gateways |
A full tunnel sends all traffic through the VPN. A split tunnel sends only company traffic through it, which saves bandwidth but lets other traffic skip company inspection.
Remote access and user management
Remote access lets staff and vendors reach internal systems from outside. Every remote path should require strong authentication, preferably multifactor, and should be logged.
User management means creating, changing and removing accounts in a controlled way. Remote access accounts for vendors and leavers are a common gap, so they need owners, expiry dates and regular review.
User access should follow least privilege. Each user gets only the systems and rights the job needs, and a VPN connection should not open the whole network by default.
Out of band management
Out of band management uses a separate path, such as a dedicated management network, a console server or a cellular modem, to administer devices. Administrators can still reach a router or firewall when the production network is down or under attack.
The management path is powerful, so it must be isolated from user traffic, strongly authenticated and logged.
File transfer and end to end encrypted messaging
| Need | Insecure choice | Secure choice |
|---|---|---|
| File transfer | File Transfer Protocol (FTP), which sends data and passwords in clear text | SSH File Transfer Protocol (SFTP) over port 22, or FTP Secure (FTPS), which is FTP over TLS |
| Messaging | Plain text email or chat | End to end encrypted messaging |
End to end encryption means only the sender and the recipient hold the keys, so the service in the middle cannot read the messages. That protects confidentiality, but it can also hide data from company monitoring and archiving, so approved tools and retention rules matter.
Security Service Edge
Security Service Edge (SSE) delivers security services from the cloud, close to the user, instead of from a central data center. It usually combines a secure web gateway (SWG), a cloud access security broker (CASB) and zero trust network access (ZTNA).
SSE suits a workforce that works from many places and uses many cloud applications. Policy follows the user, not the office network.
Identity management
| Item | Meaning |
|---|---|
| Group Managed Service Account (gMSA) | A Windows Active Directory account for services whose password is created and changed automatically by the domain, and which can be used on several servers |
| Least privilege access accounts | Accounts given only the rights a task needs, with separate accounts for admin work and daily work |
| Privilege creep | The gradual build up of rights a person no longer needs, often after role changes |
A gMSA removes the risk of a service password that never changes or that an administrator knows. Privilege creep is removed by regular access reviews and by taking old rights away when a role changes.
How the exam asks about this
- "Admins must reach the core switches even when the main network is down." -> Out of band management.
- "A service account password has not changed in five years and several admins know it." -> Use a Group Managed Service Account.
- "An employee who moved departments three times still has access from every old role." -> Privilege creep, fixed with access reviews.
What to remember for the exam
- Tunneling wraps traffic inside another protocol, and a VPN is an encrypted tunnel.
- IPsec tunnel mode protects the whole packet and is typical for gateway to gateway links.
- A split tunnel sends only some traffic through the VPN.
- Remote access needs strong authentication, logging and least privilege.
- Out of band management gives a separate path to administer devices.
- Use SFTP or FTPS instead of FTP.
- End to end encryption means only the endpoints can read the message.
- SSE delivers SWG, CASB and ZTNA from the cloud.
- A gMSA has a password managed automatically by the domain.
- Privilege creep is removed with access reviews.
When a scenario stresses that the management path must survive an outage of the main network, the answer is out of band management.
Common mistakes
Assuming a VPN makes the endpoint safe. It protects traffic in transit, but a compromised laptop can still bring malware into the network.
Confusing SFTP and FTPS. SFTP runs over Secure Shell (SSH). FTPS is FTP protected with TLS.
Thinking split tunneling is always bad. It saves bandwidth, but some traffic skips inspection, which is a risk to weigh.
Leaving the out of band network open. It controls core devices, so it needs its own strong access controls.
Using a normal user account for a service. Service accounts need managed passwords and only the rights the service needs.
A VPN that gives every user the whole internal network breaks least privilege. Limit what each connection can reach.
Check yourself
What is a split tunnel?
A VPN setup in which only traffic for the company network uses the tunnel and other traffic goes directly to the internet.
What is out of band management?
Administering devices over a separate path, such as a dedicated management network or console connection, so access survives a failure of the production network.
What is privilege creep?
The gradual build up of permissions beyond what a person's current role needs.
Topic 4 of 7 in Security Architecture
Test yourself on Security Architecture
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.