Would our company system be more secure using a VPN?

Question

I'm currently building a back-office system for our company [for internal use] that will manage our customers, accounts etc (not interested in don't reinvent the wheel comments today, thank you!). I'm building the system on a LAMP stack which will run on a server in-house (with off site backups, etc).

This may be a [really] stupid question, but we want our system to be available to staff remotely, but an internet-facing system seems a little risky for something that will contain too much important data. Would it be more secure for me to configure the server to only be available locally, meaning users would need to be connected to our VPN to access it? If I did that, as well as things like limiting login attempts, multi-stage login etc, what other things do I need to be aware of?

Answer 1

Absolutely, yes. If your users are happy with the (minor) additional effort to access the service, VPN is a great idea. Requiring a VPN will be more secure even than requiring HTTPS access to the server, because you can then tell the firewall to block all traffic to the server from outside, dramatically reducing the attack surface.

You should of course not stop at the VPN. Since this service contains a lot of important data, you will want to secure it comprehensively. Some key areas to consider are:

• "Hardening" the server(s) - disable unneeded services, make sure your patching process is good, etc.
• Securing the application - You already mention configuring the server to only respond to local requests and limiting login attempts - good ideas, do them. Consider requiring SSL anyhow. Consider two-factor. Use well established security libraries instead of trying to implement your own. Have good audit logs.
• Secure policies around the app - segregation of duties, account closure processes etc. Train the users to use good passwords.
• Don't forget there are three parts to the CIA triad - Confidentiality, Integrity, and Availability are equally important aspects of security.

The above uis a very sketchy overview. You'll find more info about these many areas by looking around the site: and of course ask more questions!

Answer 2

Yes applying multiple layers of defense such as this is part of a defense in depth strategy. Other things that I would take into consideration are:

• Implementing access and auditing policies, you may want to implement some form of two factor authentication for remote users. This will help ensure that if someones password is compromised the server will not be accessible. Whether you choose a pin based token system or something like a Yubikey this will ensure access is only permitted to authorized personnel.
• If you are only expecting users to access the system during regular business hours ensure that access attempts outside of this time frame are logged and audited.
• Ensure that there is a good password policy in place that aligns with your organization. In addition very sensitive information should be encrypted based upon any regulations, compliance issues that your company will face.