VPN Protocols

•  Point-to-Point Tunneling Protocol (PPTP)
• Obsolete - sends initial negotiation unencrypted, which can include usernames and hashed passwords.  
• Encapsulation protocol from dialup P2P. 
• Operates in Data Link layer (layer 2) 
• TCP Port 1723
• Offers:  
• Password Authentication Protocol (PAP)
• Challenge Handshake Authentication Protocol (CHAP)
• Extensible Authentication Protocol (EAP)
• Microsoft Challenge Handshake Authentication Protocol (MS-CHAP2)
• Layer 2 Tunneling Protocol (L2TP)
• Combines PPTP with Cisco's L2F
• Operates at layer 2 
• Port UDP 1701
• Can rely on PPP's supported Authentication protocols, e.g., IEEE 802.1X
• IEEE 802.1X makes it possible to use AAA services like RADIUS or TACAS+
• No native encryption but can support payload encryption protocols
• Often deployed using IPsec's ESP for encryption. 
• Secure Shell (SSH)
• Secure replacement for Telnet (TCP port 23)
• Uses TCP port 22
• Is used to encrypt protocols such as SFTP, SEXEC, SLOGIN, and SCP
• OpenSSH is used to implement SSH VPNs. 
• OpenVPN
• Based on TLS
•  Open source
• Can use pre-shared or certificates for authentication
• IP Security Protocol (IPsec)
• Collection of protocols: AH, ESP, HMAC, IPComp, IKE
• Authentication Header(AH) - provides message integrity, nonrepudiation, as well as primary authentication
• Encapsulating Security Payload (ESP) - provides confidentiality & integrity of payload contents, operates in either transport or tunnel mode. AES is used in modern IPsec ESP. 
• Hash-based Message Authentication Code (HMAC) - primary hashing for integrity
• IP Payload Compression (IPComp) - Compression prior to ESP for better speed. 
• Internet Key Exchange (IKE) - enables IPsec to use public-key cryptography & symmetric cryptography.
• Composed of 3 elements: OAKLEY, SKEME, and ISKMP

Types of Thread Modelling (Defensive/Proactive versus Reactive or Threat Hunting

Proactive Or Defensive Thread Modelling: 

Proactive approach or defensive approach to threat modelling takes place during the early stages of systems development. 

Reactive Threat Modelling: 

Threat hunting (a.k.a. reactive threat management and an adversarial approach) which takes place after a product has been created and deployed.