3

Company X has LDAP integrated WiFi (EAP TTLS/PAP). When employees connect to WiFi, they can access the public internet. However they don't have access to internal resources (for example database ports, hadoop ports etc). To access internal resources, they need to get on a VPN (SSL VPN) which used the same LDAP credentials used to access WiFi.

Question: Does the VPN make it any more secure (it uses the same password)? What would be the downside of making internal resources accessible after WiFi access? Any critique of this set up?

3

Theoretically the WIFI setup should be secure enough on its own. However, company wifi is usually provided so that people can hook there personal devices up to the internet ... providing VPN access gives people the availability of internal resources as needed while keeping the rest of riffraff out of the corp network.

This setup is a classic example of compartmentalization ... if your ifruit doesn't need access to anything more than internet for stream music ... why provide access to the internal exchange server. It significantly reduces the attack surface in the case that your ifruit has some nasty rootkit on it that you didn't know about.

It is generally considered annoying to the people who DO want access to the internal resources, but in most cases these people are the vocal minority.

  • so in general, if the argument is to use VPN simply for additional security, on top of EAP and HTTPS... Would that argument hold up? – dangel Feb 14 '17 at 18:43
  • 1
    @dangel I would say yes ... its overkill, but not in a bad way as long as your not fighting for latency / bandwidth / compute power – CaffeineAddiction Feb 14 '17 at 19:23
0

A VPN provides a few features that may be better suited for a corporate ecosystem:

  • Finer grained access control by way of security groups, entitlements and so on
  • A sandbox for downloaded data (in the case of mobile devices). For example, VPN solutions like Good or Mobile Iron also help prevent data exfiltration
  • Finer grained monitoring of access: who accessed what and when

In addition to the above, like CaffeineAddiction mentioned, VPN finds major use in compartmentalization based on functionality.

  • My bad.. Edited! :-) – katrix Nov 21 '16 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.