Well, like everything else in the security space, the answer is "it all
dependes";)
One of the first things I tell clients when they start talking about a
VPN is that they are extending their network out to the VPN endpoint.
Now that home desktop is on your network. If that home desktop has a
worm, guess what, that worm is now on your network and if it can find
one machine that's vulnerable, then you have two worms. What if that
home computer has some kind of remote management software
installed...like Back Orifice? You're probably a little short-staffed,
right...well, now you have help;)
The solutions are all over the place. If you have a Cisco VPN, then the
remote management problem is turned off by default with their split
tunnel feature. It forces all traffic through the tunnel. There are
also clients that will force a virus scan of the workstation and force
other policy changes. You can also put some restriction at the VPN
termination point so that your VPN clients are restricted in what they
do. There are all kinds of solutions but it depends on what you're
running. You're started down the right path...VPNs can be scary!
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Sohail Sarwar
Sent: Monday, June 18, 2007 9:08 AM
To: James Patterson; pen-test@securityfocus.com
Cc: holstein.robert@bls.gov
Subject: Security and VPN
Hi there,
I just wanted to put this out there. How secure is VPN.
Meaning, if my users take home the client and install it on their
desktop at home, and connect to the corporate network and production
network, wheat are we really looking at. Are they secure or not.
Two factor authentication would only help the authentication
purpose and to protect the user name and password ?
How about restricting them to access, and how about worrying
about their home computer that can be effected.
Has anyone been through this. Any one give home users a list of
requirements that they must have before vpn can be offered to them ?
Should there be some type of desktop policy installed on their
home computer, just to protect the company network ? Any help and
guidance would be great
Regards,
Sohail
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use
of the individual or entity to which they are addressed and may contain
information that is privileged, proprietary and confidential. If you are not
the intended recipient, you may not use, copy or disclose to anyone the message
or any information contained in the message. If you have received this
communication in error, please notify the sender and delete this e-mail
message. The contents do not represent the opinion of D&E except to the extent
that it relates to their official business.
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
|