5

My company provides a service to another firm and connects via VPN several times a day. The service involves accessing an intranet web-based application and copying files from one server to another when necessary.

Currently, two users connect from their PC to the firm's Cisco firewall using the Cisco VPN client whenever they need to. The PCs are turned off out of office hours. The VPN password is stored on the PC with a dedicated tool encrypting with SHA-256.

Now, the firm says we must switch to a site-to-site VPN as they deem it simpler to control. We are concerned mainly because we fear that we become an integral part of their network and become partly responsible for its safety. We think that it's easier that a hacker gets into our firewall on saturday night and penetrates the firm's network, than that a hacker gets into our network during the day and gets to the right PC at the right time when the VPN is in use.

Assuming we have a decent firewall without known vulnerabilities (and both companies aren't high profile targets), are we overly concerned with this switch? Are there any other downsides of using site-to-site versus client-based?

  • what's the difference? Instead of turning off the PCs when you leave the office, turn off your site's end of the VPN. – yzT Sep 29 '16 at 11:22
  • We'd like to avoid teaching office people how to log into the firewall and turn off a VPN... – chris Sep 29 '16 at 12:17
  • 1
    I would resist a VPN that fully linked your office network with your clients. However, you could have a site-to-site VPN that went from a highly restricted subnet on your side to their office network. You could just have a single jump box in that subnet - your guys RDP onto that, then have access to the client's network. – paj28 Sep 29 '16 at 12:19
  • @chris no one is saying to log into the firewall. It's rather as paj28 said, you just have a PC with the end-point of the VPN. Your turn off the PC, you turn off the VPN. That easy. – yzT Sep 29 '16 at 12:44
1

With respect to:

We are concerned mainly because we fear that we become an integral part of their network and become partly responsible for its safety.

Unless you have a contractual requirement imposing that responsibility it should remain their risk...there is nothing to prevent the VPN inbound connections being subject to controls to limit access/services...this should already be in place and therefore the move from client device VPN to site to site VPN should not introduce a change in this respect.

Their architecture should not be wholly reliant on the security of your network (though see below).

With respect to:

We think that it's easier that a hacker gets into our firewall on saturday night and penetrates the firm's network, than that a hacker gets into our network during the day and gets to the right PC at the right time when the VPN is in use.

It might well be that from your perspective you are correct (although it is probably a false sense of security in reality). But depending on how your laptops are accessing the Internet, the organisation you are connecting to might have to accept connections from a wide range of addresses, therefore if they can restrict this to one (known) IP address associated with a site-site VPN they are potentially reducing the attack surface applicable to their network.

Site-site VPNs can have configuration benefits versus client-site VPNs, but it depends on scenario whether these are applicable.

If they are doing things correctly they will impose legal obligations on you for allowing the connection to their system (patching, AV etc.).

If you have concerns that you may be hacked I would focus your attention on this risk rather than the type of VPN being proposed, ideally you should understand enough about your controls to have confidence in the security of your system.

1

Hmmm.

Thst you say "using the Cisco client" makes me think you are already using a VPN.

It seems odd when you are the service provider that your customer should dictate how you provide that service. Particularly if this is a purely technical service (e.g. a web based application). I can understand that if its more of a business service - such as managing multiple devices within the customers network, that a VPN would be the right solution - but for some sort of application service then a VPN is the wrong approach - by default it gives too much access which you then must tailor down to the minimum necessary to perform the function. OTOH using an TLS wrapped service, with client certificate validation, protects both you and your client.

Given that you appear to be in the situation where your customer thinks that a site to site is the only viable solution, it is of course quite possible to setup a "network" at your end which (from your perspective) appears to be part of the customer's network and simply implement a better connectivity solution from there into your actual network. But this is mostly conjecture - I know nothing about what this service is, nor your customer's motivations - you really need to speak to them and understand the problem properly (or provide more information here).

  • I added the details. In short, we need to access an internal web app and a two file servers. The company just told me they want to switch because it's easier for them to control the various external service providers with site-to-site VPNs. – chris Sep 29 '16 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.