Penetration Testing mailing list archives
RE: Security and VPN
From: "Andrew Vliet" <Andrew.Vliet () lvs1 com>
Date: Tue, 19 Jun 2007 16:42:05 -0600
Sohail Sarwar, 2 factor authentication is great, but personally I would go one further than Philip. I would not be putting VPN clients on employee owned systems. Yes, I say no clients - period. Too many variables - too insecure. I understand that it's expensive, but none the less, I would either put in a Citrix farm or purchase dedicated, company owned and maintained machines for your employees to use at home. Add the VPN client to these machines company owned machines. When considering the speed and volatility of trojans and viruses these days; Adding VPN to an unknown, uncontrolled, insecure client - even after adding Antivirus checking, etc - is simply asking for trouble. Of course, we haven't even touched on the legal and privacy implications of the company having direct access to an employee's personal network, all computers there-in and visa versa. VPN on employee machines == bad idea - don't do it. Provide Citrix or dedicated, managed machines. Regards, Andrew Vliet -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Philip Cox Sent: Tuesday, June 19, 2007 9:25 AM To: 'Sohail Sarwar'; pen-test () securityfocus com Subject: RE: Security and VPN
-----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Sohail Sarwar Sent: Monday, June 18, 2007 6:08 AM To: James Patterson; pen-test () securityfocus com Cc: holstein.robert () bls gov Subject: Security and VPN Hi there, I just wanted to put this out there. How secure is VPN. Meaning, if my users take home the client and install it on their desktop at home, and connect to the corporate network and production network, wheat are we really looking at. Are they secure or not.
Just given this decription, I would say NO, they are not secure.
Has anyone been through this. Any one give home users a list of
requirements that they must have before vpn can be offered to them ? Should there be some type of desktop policy installed on their
home
computer, just to protect the company network ? Any help and guidance
would be great
My recommendation would be to... 1. Require 2 factor authenticaiton for VPN access 2. Ensure that the VPN server/environment performs some type of system validaiton prior to letting the system have full access to the internal network. This typically includes verifying a patch level and that anti-virus is installed and up-to-date 3. Use the VPN server to restirct where the VPN client can connect 4. Review the VPN server logs for who is accessign the server and from where Just my $.02 Phil ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- Security and VPN Sohail Sarwar (Jun 18)
- RE: Security and VPN Philip Cox (Jun 19)
- RE: Security and VPN Andrew Vliet (Jun 19)
- Re: Security and VPN The Sun (Jun 19)
- RE: Security and VPN Russell Butturini (Jun 20)
- Re: Security and VPN The Sun (Jun 20)
- RE: Security and VPN Zhihao (Jun 22)
- Re: Security and VPN Robin Wood (Jun 20)
- Re: Security and VPN Ben Nell (Jun 20)
- RE: Security and VPN Russell Butturini (Jun 21)
- RE: Security and VPN Andrew Vliet (Jun 19)
- RE: Security and VPN Philip Cox (Jun 19)
- Re: Security and VPN Kurt Buff (Jun 22)