Penetration Testing mailing list archives
Re: Security and VPN
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Tue, 19 Jun 2007 12:39:37 -0700
In my "Microsoft Ninjitsu: Black belt Edition" training at Blackhat Vegas, Dr. Tom Shinder, Jim Harrison and I go into great detail about how to use ISA Server 2006 to tightly control what users can do (starting off with nothing ;) via the VPN network segment and proper rule configuration.
Any VPN access should only allow the specific protocols to/from only the machines/services that are required for users to perform a given function.
Further, ISA Server 2006 allows for the checking of a client against specific requirements one imposes to see if the client "lives" in the VPN segment, or in the case of failing standards, the quarantined network segment.
In this day and age, any corporate VPN deployment should have means in place to impose these types of restrictions and provide these security mechanisms.
t ------------- Veni, vidi, veni denuo. Timothy Mullen, MVP, MCSE, MCT, MCSD Vice President of Consulting Services NGS Software www.ngssoftware.com Check out Thor's "Microsoft Ninjitsu: Black belt Edition" at Blackhat Vegas 2007! http://www.blackhat.com/html/bh-usa-07/train-bh-us-07-tm-ms-bbe.html----- Original Message ----- From: "Sohail Sarwar" <ssarwar () ecredit com> To: "James Patterson" <jimp.securityfocus () gmail com>; <pen-test () securityfocus com>
Cc: <holstein.robert () bls gov> Sent: Monday, June 18, 2007 6:08 AM Subject: Security and VPN Hi there, I just wanted to put this out there. How secure is VPN. Meaning, if my users take home the client and install it on their desktop at home, and connect to the corporate network and production network, wheat are we really looking at. Are they secure or not. Two factor authentication would only help the authentication purpose and to protect the user name and password ? How about restricting them to access, and how about worrying about their home computer that can be effected. Has anyone been through this. Any one give home users a list of requirements that they must have before vpn can be offered to them ? Should there be some type of desktop policy installed on their home computer, just to protect the company network ? Any help and guidance would be great Regards, Sohail ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- Re: Security and VPN, (continued)
- Re: Security and VPN The Sun (Jun 19)
- RE: Security and VPN Russell Butturini (Jun 20)
- Re: Security and VPN The Sun (Jun 20)
- RE: Security and VPN Zhihao (Jun 22)
- Re: Security and VPN Robin Wood (Jun 20)
- Re: Security and VPN Ben Nell (Jun 20)
- RE: Security and VPN Russell Butturini (Jun 21)
- Re: Security and VPN Kurt Buff (Jun 22)
- RE: Security and VPN Jessie Ling XX (MC/EPA) (Jun 19)