Security of Site-to-Site VPN vs Client VPN

Question

My company provides a service to another firm and connects via VPN several times a day. The service involves accessing an intranet web-based application and copying files from one server to another when necessary.

Currently, two users connect from their PC to the firm's Cisco firewall using the Cisco VPN client whenever they need to. The PCs are turned off out of office hours. The VPN password is stored on the PC with a dedicated tool encrypting with SHA-256.

Now, the firm says we must switch to a site-to-site VPN as they deem it simpler to control. We are concerned mainly because we fear that we become an integral part of their network and become partly responsible for its safety. We think that it's easier that a hacker gets into our firewall on saturday night and penetrates the firm's network, than that a hacker gets into our network during the day and gets to the right PC at the right time when the VPN is in use.

Assuming we have a decent firewall without known vulnerabilities (and both companies aren't high profile targets), are we overly concerned with this switch? Are there any other downsides of using site-to-site versus client-based?

Answer 1

With respect to:

We are concerned mainly because we fear that we become an integral part of their network and become partly responsible for its safety.

Unless you have a contractual requirement imposing that responsibility it should remain their risk...there is nothing to prevent the VPN inbound connections being subject to controls to limit access/services...this should already be in place and therefore the move from client device VPN to site to site VPN should not introduce a change in this respect.

Their architecture should not be wholly reliant on the security of your network (though see below).

With respect to:

We think that it's easier that a hacker gets into our firewall on saturday night and penetrates the firm's network, than that a hacker gets into our network during the day and gets to the right PC at the right time when the VPN is in use.

It might well be that from your perspective you are correct (although it is probably a false sense of security in reality). But depending on how your laptops are accessing the Internet, the organisation you are connecting to might have to accept connections from a wide range of addresses, therefore if they can restrict this to one (known) IP address associated with a site-site VPN they are potentially reducing the attack surface applicable to their network.

Site-site VPNs can have configuration benefits versus client-site VPNs, but it depends on scenario whether these are applicable.

If they are doing things correctly they will impose legal obligations on you for allowing the connection to their system (patching, AV etc.).

If you have concerns that you may be hacked I would focus your attention on this risk rather than the type of VPN being proposed, ideally you should understand enough about your controls to have confidence in the security of your system.

Answer 2

Hmmm.

Thst you say "using the Cisco client" makes me think you are already using a VPN.

It seems odd when you are the service provider that your customer should dictate how you provide that service. Particularly if this is a purely technical service (e.g. a web based application). I can understand that if its more of a business service - such as managing multiple devices within the customers network, that a VPN would be the right solution - but for some sort of application service then a VPN is the wrong approach - by default it gives too much access which you then must tailor down to the minimum necessary to perform the function. OTOH using an TLS wrapped service, with client certificate validation, protects both you and your client.

Given that you appear to be in the situation where your customer thinks that a site to site is the only viable solution, it is of course quite possible to setup a "network" at your end which (from your perspective) appears to be part of the customer's network and simply implement a better connectivity solution from there into your actual network. But this is mostly conjecture - I know nothing about what this service is, nor your customer's motivations - you really need to speak to them and understand the problem properly (or provide more information here).