rity gateway Figure 6.27 A possible VPN architecture Customer premises based IP-VPN. About the same solution but with central VPN management. Network-based IP-VPN. Everything is done between edge routers. One of the driving factors in this development of enterprise networks is the minimiza- tion of costs for both equipment and maintenance. At the same time adequate security measures must be employed. The use of VPN-based tunnelled remote access sessions substantially decreases the operational costs for providing access to home workers and road warriors. This is due to the reduced need to rely on long-distance modem calls. Flexible configuration options in enterprise NASs make it possible to allow both PC-to- enterprise and operator-to-enterprise tunnels, thereby allowing the enterprises to outsource and contract remote access services from operators. VPNs can also provide gaps in security when the end node is connected to secondary networks. For example, say someone is connected to their corporate network via VPN dial-up or the Internet from their home. In their home they have a wireless network with no security in place. A hacker outside that house could connect to the PC via an unsecured connection, and share the VPN tunnel without the worker's knowledge. This is referred to as 'split tunnel' vulnerability. 6.14.2 MOBILE SYSTEMS SIM Application Toolkit The SIM Application Toolkit (SAT) is a technology that lets the SIM card issue commands to the telephone. These commands range from displaying menus and getting user input Security to sending and receiving SMS messages. The SIM toolkit is excellent for implementing security critical applications, since it allows for custom encryption. One potential draw- back is that the operator owns the SIM card, and to place applications on it you need the operator's permission. What is USIM? USIM (universal subscriber identity module) is the smart card for third generation (3G/UMTS) mobile terminals. The role of SIM cards in 3G concerns the traditional benefits of portability