From: Stong, Ian C CTR DISA GIG-CS (Ian.Stong.ctr@disa.mil)
Date: Tue Jun 19 2007 - 07:09:14 EDT
Good questions - by VPN let's assume you mean and IPSec VPN. That gives
you encryption of the data as well as the ability to disable split
tunnel so they can not access other networks while simultaneously
accessing your network.
Key risks of allowing people to VPN in from remote systems are related
directly to your questions. Unless you do policy enforcement, there is
nothing to prevent a home user from tying in using a PC that has no
firewall, virus scanner or other detection/prevention tools. Increases
the risk for remote users to pass viruses, trojans and other malicious
code.
First off develop some general purpose security guidelines that users
need to follow in order to log in. This could include the mandatory use
of fw/av/spybot software. Various VPN vendors have tools to try and
combat some of the previously mentioned risks. This includes everything
from limiting what they have access to on your network, logging and
tracking what they do, performing two factor authentication to control
who can access your network, using policy enforcement to ensure they are
running fw/av software and that it is up to date......
HTH,
Ian Stong
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Sohail Sarwar
Sent: Monday, June 18, 2007 9:08 AM
To: James Patterson; pen-test@securityfocus.com
Cc: holstein.robert@bls.gov
Subject: Security and VPN
Hi there,
I just wanted to put this out there. How secure is VPN.
Meaning, if my users take home the client and install it on their
desktop at home, and connect to the corporate network and production
network, wheat are we really looking at. Are they secure or not.
Two factor authentication would only help the authentication
purpose and to protect the user name and password ?
How about restricting them to access, and how about worrying
about their home computer that can be effected.
Has anyone been through this. Any one give home users a list of
requirements that they must have before vpn can be offered to them ?
Should there be some type of desktop policy installed on their
home computer, just to protect the company network ? Any help and
guidance would be great
Regards,
Sohail
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic See HOW Now with our 20/20
program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!
http://www.cenzic.com/c/2020
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:52 EDT