RE: Security and VPN





-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Sohail Sarwar
Sent: Monday, June 18, 2007 6:08 AM
To: James Patterson; pen-test@xxxxxxxxxxxxxxxxx
Cc: holstein.robert@xxxxxxx
Subject: Security and VPN

Hi there,

I just wanted to put this out there. How secure is VPN.
Meaning, if my users take home the client and install it on their
desktop at home, and connect to the corporate network and production
network, wheat are we really looking at. Are they secure or not.

Just given this decription, I would say NO, they are not secure.


Has anyone been through this. Any one give home users a list of
requirements that they must have before vpn can be offered to them ?

Should there be some type of desktop policy installed on their
home computer, just to protect the company network ? Any help and
guidance would be great

My recommendation would be to...

1. Require 2 factor authenticaiton for VPN access
2. Ensure that the VPN server/environment performs some type of system
validaiton prior to letting the system have full access to the internal
network. This typically includes verifying a patch level and that anti-virus
is installed and up-to-date
3. Use the VPN server to restirct where the VPN client can connect
4. Review the VPN server logs for who is accessign the server and from where

Just my $.02

Phil


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Are you using SPI, Watchfire or WhiteHat?
Consider getting clear vision with Cenzic
See HOW Now with our 20/20 program!

http://www.cenzic.com/c/2020
------------------------------------------------------------------------



Relevant Pages

  • Security and VPN
    ... How secure is VPN. ... if my users take home the client and install it on their ... network, wheat are we really looking at. ... Are they secure or not. ...
    (Pen-Test)
  • VPN and Security
    ... How secure is VPN. ... if my users take home the client and install it on their ... network, wheat are we really looking at. ... Are they secure or not. ...
    (Security-Basics)
  • Re: Fortigate Experiance / Review
    ... We spent about an hour with support yesterday to get the VPN working, ... Others have the full install and it is still troublesome. ... I teach Fortigate courses. ... firewall FIRST if you want to use the forticlient firewall. ...
    (comp.security.firewalls)
  • Re: HIPAA and firewalls
    ... something I can install and forget for months on end. ... You can setup a Branch Office VPN tunnel in about 10 minutes if you have ... the firewall to firewall VPN tunnels setup and treat the entire thing as ... Setting up the VPN tunnels between offices is the proper way to do it ...
    (comp.security.firewalls)
  • Re: Fortigate Experiance / Review
    ... We spent about an hour with support yesterday to get the VPN working, ... have the full install and it is still troublesome. ... I teach Fortigate courses. ... You must must must turn off any other firewall ...
    (comp.security.firewalls)