UK VPN security is outstandingly mediocre
BOFHs struggle with TLAs
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
The security of corporate remote access setups has slipped over the last 12 months, according to security audits by penetration testing firm NTA Monitor.
NTA's VPN Security Report 2007 shows that IT organisations have a third fewer vulnerabilities per test than cropped up in the equivalent study last year. But organisations in other sectors (such as government and finance) are running even more insecure set-ups.
"Although the IT sector has clearly improved its security over the past year, that's not the case for everyone. On average, nine vulnerabilities were found per VPN test performed in last year's report; that figure has risen to 11 in this year's report," explained Roy Hills, technical director and founder of NTA Monitor. "Seventy-three per cent of tests also discovered at least one medium level flaw, indicating that external users may be able to disrupt services or potentially obtain unauthorised access."
The majority of vulnerabilities uncovered by NTA Monitor (65 per cent) in all the tests were rated as low-risk, generally involving the leakage of information that could be valuable to attackers. Medium risk flaws - more serious risks that create a potential means for external attackers to disrupt a VPN service or gain unauthorised access to corporate networks - made up 16 per cent of the flaws identified. The remaining 18 per cent of vulnerabilities uncovered were considered informational, highlighting issues such as poor housekeeping.
NTA recommends operating VPN connections through a dedicated VPN system rather than a firewall, improving encryption and authentication methods and undertaking regular independent security testing (as well it might). ®
COMMENTS
@ A Hawdon
I think that fixit_f's point was that their IT dept places more trust in a basic firewall from Cisco than an open source version on another OS. Would you really trust an IT dept that couldn't be bothered to do even a little research about common security tools?
My experience with Cisco VPN is that the same VPN functionality is provided by all the clients that Cisco provide for various OS - with regard to providing an IPSec based, secure channel between client and LAN. If the machine is question is allowed on the LAN when in the office and has a proven firewall in place then I can not see an issue with trust when it comes to setting up a VPN connection. Also, I would be interested to know if the VPN client check ensures that the Cisco firewall is active as a user can disable the functionality.
Now if the issue is about controlling which OS that can access the LAN then that is a different issue entirely.
Linux at work...
fixit_f,
To authorise the connection of a new device/OS to the company's VPN the IT department has to audit the device to ensure it satisfies certain criteria. Going forward they would also be responsible for ensuring that future releases don't introduce any problems, as well as keeping up to date with patches and ensuring that all users do the same. This all incurs significant administrative overhead and possibly additional skills and expertise.
When they purchased the product from Cisco it came with certain assurances from the vendor that carry a lot of weight. A lot more weight, in terms of corporate risk management, then a bunch of academics on a mailing list extolling the virtues of this 'Linux' thing.
You may expect them to make an exception becuase you're 'special' and you 'know what you're doing', but it frankly isn't worth the risk (to the company, and the IT dept as individuals with responsibilies), and to do it properly isn't worth their time. If home working is a requirement then I suggest you install VMWare on your Linux system and then request the company purchase a copy of XP that you can install on it and use this to do your work.
(I use Linux and it's great and I wish I could install it on my work PC but I understand why I can't)
VPN
Unfortunately you get people who take VPN security too seriously. My workplace specifically ban my linux machine (or other people's Macs) from connecting to VPN because they can't be arsed to test whether IPTables is as good a firewall as the stateful firewall that comes with the windows-only version of the Cisco VPN client, so they set something that won't connect you if you aren't using it. This doesn't make an awful lot of sense to me, I suspect they're just lazy sods who can't be arsed to deal with anyone with the imagination to use a different platform at home. So unfortunately I have no choice but to pollute my home machine with windows and dual boot. Gits.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
