Authentification vs Encryption in a system to system interface

From: Tom S. (mailjunk@woh.rr.com)
Date: 02/27/03 

From: mailjunk@woh.rr.com (Tom S.)
Date: 27 Feb 2003 10:25:38 -0800

Hello,

I'm afraid I'm something of a newbie and if this question is posted in
the wrong place, I apologize. I have a pretty basic question. The
company I work for is replicating data from one system to another
using a 3rd party product that doesn't use any logon/authentification
when connecting to a remote system. I'm concerned about the security
risks. When I talked to the people in charge of the project they told
me that the data would traverse a VPN and firewalls would insure that
the data would only be allowed to come from certain IP addresses and
ports and that should be good enough. I continued to argue that I'm
worried about a lack of authentification upon connection. I don't
know how any discretionary access controls would be applied to data
being shipped if there was no logon -- authentification. The response
was okay, we'll implement the SSL (Blowfish) version of the
replication software. I said okay, but then you're just going to
encrypt data that will be encrypted on the VPN. From what I've read,
SSL doesn't always provided authentification, at lease not without a
X.509 certificate. And then we would have to figure out how to manage
keys. I'm concerned about non-repudiation, lack of logs, and not
being able to apply DAC to the instance that receives the data.

All this said, I'm I way out of line? If not, can anyone help me to
make my argument?

Thanks,

Tom