The job I have requires that we have computers at home, a few years ago they had everyone install a VPN on our home personal computers (the company did not provide us with these computer) how safe if this, does the company now have access to our personal information? Is this legal?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
I won't answer the legal question as it varies from location to location, but I will say that many companies in the US and EU are moving to a bring your own device (BYOD) model, where employees supply their own equipment. They wouldn't be doing that if it wasn't legal. Employees using their own equipment to access company resources is nothing new. The answers to your other questions are partially determined by the VPN software. If the software is standard, off the shelf vendor software like Checkpoint Securemote or Cisco's VPN client then the software itself is pretty safe, they are well written, tested for vulnerabilities, and they don't have functionality in them that spy on your computer. The final consideration depends on how safe your computer is. A VPN is two-way, so if you can connect to company systems they can in turn connect to yours. If your computer is well locked down, using NIST standards for example, and your OS and applications are up to date with a good AV product installed then you should be pretty safe. If you are sharing drives without requiring strong credentials, have poor passwords, or guest accounts for example it would be easy for people to access data on your computer if you employer's VPN device rules allow it. |
|||||||
|
|
When the VPN is on, you can consider that your computer is part of the company network. This means you can access the services provided by your firm network (remote computer, printers, ...). If your machine provides services over the network, then these services are also available for anyone located on the enterprise network. They also can be member on their own VPN. Avoiding this can be achieve in many ways:
Besides this, you are not free from exploits in the VPN piece of software or even a human malicious who provides you a VPN software with a virus charge, designed to allow spying on you. At some point, there has to be trust. On the legal part, this is so dependent on the location that I can't go into this. Regarding the "is it safe" thing, I personally would avoid providing VPN access for computer I do not fully manage. The firm has more to lose than you. |
|||
|
|
|
VPN connections are like any other network connection. They allow packets to flow in both directions. Whether or not it's possible for a "new" connection to be established (for example, a TCP SYN to be sent) in a particular direction is the responsibility of packet filtering rules. Does your VPN client includes its own packet filters? Does it create a pseudo network interface that can be subjected to packet filtering built into your OS or other firewall software? These are the questions you need to consider in order to answer your question. Some closed-source VPN clients totally circumvent system-wide packet filters, and you are at the mercy of its operational parameters, which in some cases are managed from the VPN server. |
|||
|
|
|
You haven't said whether you installed a client or a server. If you installed server (which doesn't make sense) and they know the credentials, then yes, they may access your computer. Legal? If they know the credentials that mean that you gave them to them, so they aren't breaking any law. This is just like the trend right now of some companies asking employees their Facebook password. If you are so stupid to do such action, it's your own fault. |
|||||
|
