Certified: SANS GIAC GSEC Audio Course

In Episode Sixty-One, “Crypto Tools: V P N s, S S H, G P G, and Disk Encryption,” we explore the practical side of cryptography as it appears in tools that professionals rely on every day. These are the mechanisms that quietly safeguard communications, files, and devices behind the scenes. While much of cryptography feels abstract—built on math, keys, and algorithms—its applied form shows up in tangible technologies that anyone can learn to use correctly with the right mindset. This episode moves through those practical examples, showing how encryption and authentication come together to protect privacy, integrity, and control across networks and systems.

A virtual private network, or V P N, is often the first applied cryptographic tool people encounter. Its purpose is to create a trusted connection through an untrusted medium, such as the public internet. At its core, a V P N secures three things: privacy, integrity, and reachability. Privacy ensures that outsiders cannot see what data travels between endpoints. Integrity guarantees that packets are not altered while in transit. Reachability provides that systems separated by geography or policy can communicate as if they were local. Each of these goals addresses a real threat—eavesdropping, tampering, or restricted access—and together they form the foundation of why organizations deploy V P Ns in the first place.

The concept of a tunnel is central to how a V P N operates. A tunnel is a logical connection that encapsulates traffic from one network into another, shielding its contents. There are generally two broad models. In a site-to-site tunnel, entire networks connect to each other securely, often between data centers or branch offices. In remote-access tunnels, individual users connect securely to a corporate network from wherever they are. Both models rely on establishing trust between endpoints, often through digital certificates or pre-shared keys. The result is a secure pipe where internal data can move without being exposed to the public internet.

V P N protocols come from two major families: I P sec and T L S. I P sec operates at the network layer, securing all traffic regardless of the application generating it. It is powerful for infrastructure-level protection, such as linking two subnets or securing routing updates. T L S, short for transport layer security, operates one layer higher. It protects specific sessions—like those initiated by web browsers or custom applications. The difference shapes both deployment and performance. I P sec requires more coordination across network devices, while T L S can be embedded into individual services. Knowing which family fits a given use case is a skill that blends cryptographic understanding with operational pragmatism.

A recurring design choice in V P N setups is whether to use split tunneling. This feature determines which traffic flows through the encrypted tunnel and which takes a direct route to the internet. Split tunneling can improve performance because local or public traffic avoids the corporate network path, reducing latency and congestion. However, it also introduces risk. If a system is simultaneously connected to the corporate network and the public internet, an attacker could exploit that dual path to bridge into the protected environment. The decision becomes one of balancing performance against exposure, and administrators must weigh convenience carefully against the principle of least privilege.

Authentication within these tools determines how securely the tunnel begins. Some implementations rely on digital certificates issued by internal or public certificate authorities. Others use hardware tokens, time-based one-time passwords, or traditional credentials protected by secrets. Certificate-based authentication provides strong identity assurance and simplifies scaling across many users. Token-based systems add a dynamic factor, limiting the usefulness of stolen credentials. The key principle remains the same: a tunnel is only as secure as the process that establishes it. Poor key management or shared secrets can undo even the best cryptographic design.

Another common cryptographic workhorse is S S H, or secure shell. This protocol replaced insecure remote login methods and has become essential for system administration and automation. S S H uses key pairs instead of passwords to establish trust. The private key remains on the client system, while the public key resides on the server. Agents help manage those keys so users do not need to repeatedly enter passphrases. Forwarding allows secure chaining of sessions without exposing credentials on intermediate systems. Each of these features embodies a principle of minimizing trust—ensuring that control is delegated only as far as necessary while keeping secrets contained.

File transfer over S S H often introduces new considerations. Tools such as S C P and S F T P use the same underlying cryptography but differ in usability and error handling. S C P moves files quickly but lacks granular resume options, while S F T P offers more robust control. Both depend on verifying the host’s key fingerprint to prevent impersonation attacks. Even simple transfers can become security exposures if those verifications are skipped or automated without review. Understanding the cryptographic handshake behind the convenience helps practitioners avoid complacency in environments where every connection matters.

Beyond transport and access, encryption also protects the files themselves. G P G, or GNU Privacy Guard, extends the principles of public-key cryptography to personal communication and document security. It allows users to generate key pairs, distribute their public keys, and use them to sign or encrypt data. The underlying idea is trust through transparency—participants can verify that a message truly came from a known key holder and has not been altered. This makes G P G invaluable in communities where email and file authenticity are essential.

The web of trust model that G P G promotes differs from traditional centralized approaches. Instead of one certificate authority vouching for everyone, individuals sign each other’s keys to express confidence in their ownership. Over time, this creates a distributed map of trust relationships. While the model can be messy to manage, it aligns with the open-source ethos that spawned it. Users retain control over who they trust and how far that trust extends. This autonomy reinforces one of cryptography’s cultural values: decentralization as a means of resilience.

G P G also distinguishes between signing, encrypting, and doing both. Signing proves authenticity—showing that a known private key holder created the content. Encrypting ensures confidentiality—preventing anyone else from reading it. Combining both gives the strongest assurance that a message is genuine and private. However, the order matters; signing first and then encrypting protects both the identity and the content, while encrypting first would hide the signature’s validity. Understanding these subtle differences separates secure practice from partial protection, especially when scripts or automation handle repetitive tasks.

Turning from data in motion to data at rest, disk encryption serves a different but equally critical purpose. Its goal is to protect information when a device is lost, stolen, or decommissioned. Without disk encryption, an attacker could simply remove a drive and read its contents directly. Encryption at rest closes that gap by requiring a cryptographic key before any data becomes intelligible. This protection is invisible during normal use but decisive in moments of incident response, where the absence of such safeguards often leads to catastrophic data disclosure.

Disk encryption appears in two major forms: full-disk and file-level. Full-disk encryption protects the entire storage device, including the operating system and swap files. Once unlocked at boot, it secures the environment holistically but cannot protect data once the system is running. File-level encryption, by contrast, targets specific directories or archives, maintaining protection even while the rest of the system operates normally. The right choice depends on the threat model—broad defense against device loss or fine-grained control over individual files. Both use the same mathematical foundation but differ in operational trade-offs.

With any form of encryption, key management remains the quiet but vital responsibility. Recovery keys and escrow mechanisms ensure that legitimate access can be restored after a password reset, employee departure, or hardware failure. Mishandling these safeguards can lock an organization out of its own data or expose it to misuse. Proper escrow practices involve storing recovery material in sealed, auditable repositories accessible only under dual control. This is one of those moments where policy and technology meet: the cryptography works, but governance must keep pace to maintain trust and accountability.

Ultimately, every cryptographic tool serves a purpose, and the professional’s task is to align that purpose with real-world needs. V P Ns protect connections, S S H secures administration, G P G preserves communication, and disk encryption defends devices. None are magic shields, and each depends on careful configuration, sound key management, and user discipline. The art lies in choosing wisely—deploying the right protection for the right layer of risk. As the field matures, it becomes clear that cryptography is not about secrecy for its own sake but about maintaining confidence that systems, data, and people can depend on each other in an untrusted world.