Penetration Testing mailing list archives
RE: Security and VPN
From: "Stong, Ian C CTR DISA GIG-CS" <Ian.Stong.ctr () disa mil>
Date: Tue, 19 Jun 2007 07:09:14 -0400
Good questions - by VPN let's assume you mean and IPSec VPN. That gives you encryption of the data as well as the ability to disable split tunnel so they can not access other networks while simultaneously accessing your network. Key risks of allowing people to VPN in from remote systems are related directly to your questions. Unless you do policy enforcement, there is nothing to prevent a home user from tying in using a PC that has no firewall, virus scanner or other detection/prevention tools. Increases the risk for remote users to pass viruses, trojans and other malicious code. First off develop some general purpose security guidelines that users need to follow in order to log in. This could include the mandatory use of fw/av/spybot software. Various VPN vendors have tools to try and combat some of the previously mentioned risks. This includes everything from limiting what they have access to on your network, logging and tracking what they do, performing two factor authentication to control who can access your network, using policy enforcement to ensure they are running fw/av software and that it is up to date...... HTH, Ian Stong -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Sohail Sarwar Sent: Monday, June 18, 2007 9:08 AM To: James Patterson; pen-test () securityfocus com Cc: holstein.robert () bls gov Subject: Security and VPN Hi there, I just wanted to put this out there. How secure is VPN. Meaning, if my users take home the client and install it on their desktop at home, and connect to the corporate network and production network, wheat are we really looking at. Are they secure or not. Two factor authentication would only help the authentication purpose and to protect the user name and password ? How about restricting them to access, and how about worrying about their home computer that can be effected. Has anyone been through this. Any one give home users a list of requirements that they must have before vpn can be offered to them ? Should there be some type of desktop policy installed on their home computer, just to protect the company network ? Any help and guidance would be great Regards, Sohail ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------ ------------------------------------------------------------------------ This List Sponsored by: Cenzic Are you using SPI, Watchfire or WhiteHat? Consider getting clear vision with Cenzic See HOW Now with our 20/20 program! http://www.cenzic.com/c/2020 ------------------------------------------------------------------------
Current thread:
- RE: Security and VPN, (continued)
- RE: Security and VPN Russell Butturini (Jun 20)
- Re: Security and VPN The Sun (Jun 20)
- RE: Security and VPN Zhihao (Jun 22)
- Re: Security and VPN Robin Wood (Jun 20)
- Re: Security and VPN Ben Nell (Jun 20)
- RE: Security and VPN Russell Butturini (Jun 21)
- Re: Security and VPN Kurt Buff (Jun 22)
- RE: Security and VPN Jessie Ling XX (MC/EPA) (Jun 19)