RE: [fw-wiz] risk level associated with VPNs?

rlmieth_at_arcol.org
Date: 02/05/05

  • Next message: Bruce Smith: "RE: [fw-wiz] risk level associated with VPNs?" 
    To: <avishai_w@yahoo.com>, <firewall-wizards@honor.icsalabs.com>
Date: Sat, 5 Feb 2005 17:27:11 +0100

    Dear Avishai,
            Though your scenario may add a level of security, in practice it may introduce certain inefficiencies in the system which would prove unnecessary. The reason for the VPN is to establish a trusted WAN link. As IPS, IDS and log analysis are necessary in both circumstances; it does not appear to make that much of an impact to call for such a move. I would be very interested in hearing other opinions as well.

    Lindsay Mieth
    AGS, LC.
    Av. Morones Prieto #791 pte.
    San Pedro, Garza García
    66230 NL México
    52 81 81149790 (tel/fax) / 52 81 80636252 (cel 1) / 52 81 12127982 (cel 2)

    -----Original Message-----
    From: Avishai Wool [mailto:avishai_w@yahoo.com]
    Sent: Thursday, February 03, 2005 16:55 PM
    To: firewall-wizards@honor.icsalabs.com
    Subject: [fw-wiz] risk level associated with VPNs?

    Dear all,

    While doing firewall policy analyses for customers,
    I very often come across rules that allow
      any ip traffic
      from anywhere outside the primeter
      into big portions of the inside networks
    but over a VPN link (i.e., encrypted & authenticated).

    let's put aside the question of whether the authentication is
    sufficient, and assume that nobody is cracking the passwords.
    I tend to trust the encryption and believe that noone can snoop
    the traffic in flight.

    My claim is that these rules are very risky and a wonderful
    vector for all kinds of malware. All those home
    computers, laptops on the road etc, are much more at risk
    of infection than inside computers are. Plus the VPN has the
    nice side-effect that filters can't see though the encryption
    and control (or even log) where the connection is going
    and what it is doing.

    Left to my own devices, I would recommend terminating the VPNs
    in a DMZ, and putting all the usual controls (anti-virus/mail filter/etc)
    between the DMZ and the inside, and I would flag these raw VPN connections
    as risky, maybe even very risky.

    However, customers uniformly disagree with this argument, and tell me that
    "traffic coming over a VPN is not perceived as a risk so shut up
    about it."

    Thoughts anyone?
    Any credible war stories about malware/abuse traveling over VPNs?
    Or are the customers right and I'm being paranoid?
     (please don't respond that "the customer is always right" :-)

    Thanks,
      Avishai

    =====
    Avishai Wool, Ph.D.,
    http://www.algosec.com http://www.eng.tau.ac.il/~yash
    yash@acm.org Tel: +972-3-640-6316 Fax: +972-3-640-7095

    __________________________________________________
    Do You Yahoo!?
    Tired of spam? Yahoo! Mail has the best spam protection around
    http://mail.yahoo.com
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Bruce Smith: "RE: [fw-wiz] risk level associated with VPNs?"

    Relevant Pages

    • Re: XP NETWORK HELP PLEASE
      ... The gigabit switch feeds the ... router not to broadcast the ssid and have a hidden mapped network drive ... dispatch log on one screen and our customers in-house proprietary software on ... We use Cisco's VPN software that came to us via a disk from ...
      (microsoft.public.windowsxp.general)
    • [fw-wiz] risk level associated with VPNs?
      ... While doing firewall policy analyses for customers, ... but over a VPN link ... My claim is that these rules are very risky and a wonderful ...
      (Firewall-Wizards)
    • Re: WSS 3.0 Survey
      ... Your customers will have to be able to access a server that is accessible via the Internet if they can't make a VPN connection to fill out your surveys. ... You could create the surveys in the hosted SharePoint site and download the survey results and load it into your internal SharePoint site. ...
      (microsoft.public.sharepoint.windowsservices)
    • Re: [fw-wiz] risk level associated with VPNs?
      ... > While doing firewall policy analyses for customers, ... The majority of VPN vendors still allow their implementations to leak ... > and control where the connection is going ... > Or are the customers right and I'm being paranoid? ...
      (Firewall-Wizards)
    • Re: SHA-1 Believed Broken according to Schneier
      ... ISTR that they had the CIA spy on Airbus during negotiations ... >> with customers before. ... > No encryption involved, though. ... >> Because its less risky. ...
      (sci.crypt)
    Loading