Tag Info

Hot answers tagged

5

According to PCI, you have 3 kind of networks: 1. INTERNAL (Cardholder Data Enviroment) 2. DMZ 3. INSECURE If your VPN network is considered as DMZ network, then it's under PCI scope, just like every other device in DMZ zone. If your VPN network is considered as INSECURE network, then you shouldn't allow direct connection to the servers in INTERNAL ...


3

No, this is correct, you are putting PPP packets into your SSH connection. The idea of a VPN is that you are tunnelling, which basically means that you have an SSH connection (a tunnel) that looks like PPP when you are sending something into it. Thus, if you send a request through your tunnel with a protocol like HTTPS, your packet on the wire will look ...


3

I assume you want to prevent your employees from using their personal computers to access your work network via VPN. You can't prevent them from installing VPN software on their home computers, but you can disallow VPN connections from systems using Posture Checking. Posture Checking involves the VPN server querying the VPN client for information prior to ...


2

IANAQSA... Is the reason for this explanation that the VPN connecting machine is not under PCI DSS scope, so it's treated as unsecure/public access, or does VPN eliminate that notion? First of all, if you have a VPN, you must have 2-factor authentication to make it PCI compliant. You didn't mention that, so I figured it should be made explicit. ...


2

Is using L2TP/IPsec VPN over NAT-T actually insecure, or is this only a theoretical risk? Microsoft says Yes and No: Yes in case this scenario applies on you: A network address translator is configured to map IKE and IPSec NAT-T traffic to a server on a NAT-configured network. (This server is Server 1.) The network address translator ...


2

In theory, yes, the webrtc standard let's a website determine your local ip address, so it can create a direct connection for you to a another web-browser, allowing direct connections between browsers to set up video streaming for example. This website has a proof of concept showing you your internal and external ip address: ...


1

The answer is yes because SSTP also relies on SSL3.0, so nothing, apart from disabling SSL3.0 from both client and server sides, prevents this session to be hijacked by an attacker and thus sensitive information might be disclosed. Also SSTP, as far as I know, is not standardized yet so this may cause problems when it comes to interoperability. By the time ...


1

I think the most straightforward way to do this would be to use container linking. The exact solution depends on whether your containers that you want to access via this VPN are on different VMs / physical servers or not. If the containers are on the same server Essentially you would run your VPN server in it's own container, and link all the other ...


1

I suspect that it's not realistically possible to use this exploit against SSTP. According to that answer, the attacker needs to be able to do two things in order to be able to exploit this vulnerability: inject data of their own before and after the secret value that he wants to obtain; inspect, intercept and modify the resulting bytes on the wire. The ...


1

If everything with the VPN is working correctly, nobody can see what you are browsing. The most that they can tell is that you've created a VPN connection to your VPN provider.


1

People can still trace you with other methods. Just because your IP is different and your traffic is encrypted in a tunnel doesn't mean you can't be tracked. There are other ways people can track you. For example: they can find who you are by doxing your IP isn't the only thing that identifies you on the internet your VPN service can see your IP and what ...


1

I suppose another approach is "punt on public AP whenever possible, and tether to a VPN connection over your phone instead". Chews up data though. You have basically two strategies for your risk (surfing on a public AP). Elimination: Not using it Mitigation: Taking precautions to reduce the probability and impact of having information disclosed. ...


1

Let me give you a disclaimer first. Any advice given will be trumped by your QSA and because I have a limited scope of your network I can only provide guidance. Based on your question, you should have at a minimum, two zones, your DMZ where your application is running, and your internal zone where the data is being held ( I typically refer to this as the ...


1

X-Forwarded-For header may be used to forward client's real IP in case of source NAT. But not all application use them. This header is often inserted by load-balancers or reverse-proxies, depending the architecture in place, when the application needs to know the real IP belonging to a client. When this header is inserted, the application can see 2 IPs: ...



Only top voted, non community-wiki answers of a minimum length are eligible