3

Company X has LDAP integrated WiFi (EAP TTLS/PAP). When employees connect to WiFi, they can access the public internet. However they don't have access to internal resources (for example database ports, hadoop ports etc). To access internal resources, they need to get on a VPN (SSL VPN) which used the same LDAP credentials used to access WiFi.

Question: Does the VPN make it any more secure (it uses the same password)? What would be the downside of making internal resources accessible after WiFi access? Any critique of this set up?

Improve this question

2 Answers 2

Reset to default
3

Theoretically the WIFI setup should be secure enough on its own. However, company wifi is usually provided so that people can hook there personal devices up to the internet ... providing VPN access gives people the availability of internal resources as needed while keeping the rest of riffraff out of the corp network.

This setup is a classic example of compartmentalization ... if your ifruit doesn't need access to anything more than internet for stream music ... why provide access to the internal exchange server. It significantly reduces the attack surface in the case that your ifruit has some nasty rootkit on it that you didn't know about.

It is generally considered annoying to the people who DO want access to the internal resources, but in most cases these people are the vocal minority.

Improve this answer
2
  • so in general, if the argument is to use VPN simply for additional security, on top of EAP and HTTPS... Would that argument hold up?
    – dangelsaurus
    Commented Feb 14, 2017 at 18:43
  • 1
    @dangel I would say yes ... its overkill, but not in a bad way as long as your not fighting for latency / bandwidth / compute power
    – CaffeineAddiction
    Commented Feb 14, 2017 at 19:23
0

A VPN provides a few features that may be better suited for a corporate ecosystem:

  • Finer grained access control by way of security groups, entitlements and so on
  • A sandbox for downloaded data (in the case of mobile devices). For example, VPN solutions like Good or Mobile Iron also help prevent data exfiltration
  • Finer grained monitoring of access: who accessed what and when

In addition to the above, like CaffeineAddiction mentioned, VPN finds major use in compartmentalization based on functionality.

Improve this answer
1
  • My bad.. Edited! :-)
    – katrix
    Commented Nov 21, 2016 at 18:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .