Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The job I have requires that we have computers at home, a few years ago they had everyone install a VPN on our home personal computers (the company did not provide us with these computer) how safe if this, does the company now have access to our personal information? Is this legal?

share|improve this question
1  
By saying "hey had everyone install a VPN on our home personal computers". Do you mean they told you to install a VPN client? –  Adnan Feb 18 '13 at 13:04
    
If you are afraid of having something on your home computer that needs to be protected, buy a old laptop for work. If the company wants you to work 24 X 7, they should pay for a company laptop. –  user20926 Feb 19 '13 at 12:16
    
"is this legal" transforms the question into something that is very localized. "legal" changes from state to state and country to country. The FAQ discourages localized questions. –  Mark C. Wallace Feb 19 '13 at 12:34
add comment

4 Answers

I won't answer the legal question as it varies from location to location, but I will say that many companies in the US and EU are moving to a bring your own device (BYOD) model, where employees supply their own equipment. They wouldn't be doing that if it wasn't legal. Employees using their own equipment to access company resources is nothing new.

The answers to your other questions are partially determined by the VPN software. If the software is standard, off the shelf vendor software like Checkpoint Securemote or Cisco's VPN client then the software itself is pretty safe, they are well written, tested for vulnerabilities, and they don't have functionality in them that spy on your computer.

The final consideration depends on how safe your computer is. A VPN is two-way, so if you can connect to company systems they can in turn connect to yours. If your computer is well locked down, using NIST standards for example, and your OS and applications are up to date with a good AV product installed then you should be pretty safe. If you are sharing drives without requiring strong credentials, have poor passwords, or guest accounts for example it would be easy for people to access data on your computer if you employer's VPN device rules allow it.

share|improve this answer
    
Your first paragraph would be true if you were posting this a year ago. Actually companies are avoiding BYOD due to the security risks. Just check most popular LinkedIn's groups in information security. –  yzT Feb 18 '13 at 13:16
    
I'm not saying BYOD is a good idea for many companies. It often costs more to do it securely. But it is happening. –  GdD Feb 18 '13 at 13:19
    
@GdD agreed, BYOD is a huge industry and there's currently a race in adressing it. People want their iPhones instead of old outdated blackberries for example and software is being written to emulate enterprise functionality. –  NULLZ Feb 18 '13 at 14:10
add comment

When the VPN is on, you can consider that your computer is part of the company network. This means you can access the services provided by your firm network (remote computer, printers, ...).

If your machine provides services over the network, then these services are also available for anyone located on the enterprise network. They also can be member on their own VPN.

Avoiding this can be achieve in many ways:

  • Do not provide services over the VPN network (it usually has its own IP address range and service can be configured to behave differently depending on the network)
  • Firewall the services when not on your home network, to avoid connections from the entreprise
  • VPN connections may be established in such way that VPN client can only access the enterprise network and not been reached from it. Eventually there may remain attack vectors left to reach your machine, since you do communicate with the servers and this implies a bi-directional link is established.

Besides this, you are not free from exploits in the VPN piece of software or even a human malicious who provides you a VPN software with a virus charge, designed to allow spying on you. At some point, there has to be trust.

On the legal part, this is so dependent on the location that I can't go into this.

Regarding the "is it safe" thing, I personally would avoid providing VPN access for computer I do not fully manage. The firm has more to lose than you.

share|improve this answer
add comment

VPN connections are like any other network connection. They allow packets to flow in both directions. Whether or not it's possible for a "new" connection to be established (for example, a TCP SYN to be sent) in a particular direction is the responsibility of packet filtering rules.

Does your VPN client includes its own packet filters? Does it create a pseudo network interface that can be subjected to packet filtering built into your OS or other firewall software? These are the questions you need to consider in order to answer your question. Some closed-source VPN clients totally circumvent system-wide packet filters, and you are at the mercy of its operational parameters, which in some cases are managed from the VPN server.

share|improve this answer
add comment

You haven't said whether you installed a client or a server. If you installed server (which doesn't make sense) and they know the credentials, then yes, they may access your computer.

Legal? If they know the credentials that mean that you gave them to them, so they aren't breaking any law.

This is just like the trend right now of some companies asking employees their Facebook password. If you are so stupid to do such action, it's your own fault.

share|improve this answer
    
VPN's are networks. Which direction of traffic flow allows new connections to be established is unrelated to which machine is the client or server. –  ruief Feb 18 '13 at 13:28
    
If you have client installed, the connection is ONLY established when you want. If you have server, they can connect to your machine whenever they want. I guess OP is asking for the latter. –  yzT Feb 18 '13 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.