RE: How safe is a VPN connexion from within an internal network?

["Quark IT - Hilton Travis" <Hilton () quarkit com au>]

> -----Original Message-----
> From: listbounce () securityfocus com
> On Behalf Of PIERRE.DUFRESNE () MESS GOUV QC CA
> Sent: Tuesday, 21 November 2006 2:47 AM
>
> Hi all!
>
> I have been asked to install a vpn client on a workstation inside our
> network that would access another network through our firewall.
> Besides the technical details of allowing IPSec traffic through a
NATed
> device,  I was wondering how safe is this practice? Is it done often?
> Once the connexion is established, can a host on the external network
> access the workstation inside my network, ie initiate a connexion?
> Should I rather go with a "site to site" vpn connexion?
>
> Thanks for your time
>
> Pierre

Hi Pierre,

This sort of thing is done all the time in all sorts of networks.  Now,
if you are concerned with a remote user connecting to internal
computers, why are you not concerned if they connect to the gateway to
your network, instead of to one machine?

Remember that a VPN is a NETWORK between devices.  If you make it
between two networks, then all machines have access to all machines on
both networks, restricted by internal access security such as firewalls,
IPSEC policy, ACLs and so on.

--

Regards,

Hilton Travis                          Phone: +61 (0)7 3344 3889
(Brisbane, Australia)                  Phone: +61 (0)419 792 394
Manager, Quark IT                      http://www.quarkit.com.au
         Quark AudioVisual             http://www.quarkav.net

War doesn't determine who is right.  War determines who is left.

This document and any attachments are for the intended recipient 
  only.  It may contain confidential, privileged or copyright 
     material which must not be disclosed or distributed.

                    Quark Group Pty. Ltd.
      T/A Quark Automation, Quark AudioVisual, Quark I

---------------------------------------------------------------------------
This list is sponsored by: Norwich University

EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The NSA has designated Norwich University a center of Academic Excellence
in Information Security. Our program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Using interactive e-Learning technology, you can earn this esteemed degree,
without disrupting your career or home life.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------