3

I see many big companies using VPNs to secure traffic between their empoyees' computers and their servers or just between different servers.

At what point does that become necessary for a smaller-scale company?

I guess the best answer should be to do an in-depth threats and risks analysis, but is this something many startups (or SMEs) set up?

Also, how often do companies set up VPNs between servers in the same datacenter? For example, we have several dedicated servers at OVH, with some services speaking cleartext (Redis for example), what is the risk of interception?

  • 3
    You hit the nail on the head in your question. VPNs are a tool. Whether you need the tool depends on your problem. – schroeder Jan 16 '17 at 12:43
  • 1
    How would a remote worker in a small company access company resources? That's the bigger question (and not a security issue). – schroeder Jan 16 '17 at 12:45
  • Most of our tools already use secured traffic (documents are on GSuite, the platform we build is HTTPS+HSTS, we connect to our servers with SSH, etc.) But isn't a VPN an added security measure? What about servers inside the same datacenter speaking cleartext? – A. Ellis Jan 16 '17 at 13:21
  • How would you create a VPN to Google? What threats are in your datacenter that a VPN would address? – schroeder Jan 16 '17 at 13:27
2

A VPN allows two different entities separated by out of control network elements to be seen as members on a single controlled network (definition of Virtual Private Network). So:

  • if all your servers are on same LAN inside your own building, then you do not need a VPN between them
  • if employees only use ssh to connect to a server, then you do not need a VPN for that access (ssh already offers an end to end security)
  • if you have different servers in a datacenter, and you have no control whether other servers share the same network, then a VPN to isolate you servers exchanges would make sense.
  • if you need to use various protocols between your employees's computers and your servers, and the exchanges and not limited to your LAN, then again a VPN would make sense
  • Don't necessarily agree on the second point. A VPN allows you to firewall off port 22 from anywhere other than the internal network, which eliminates most attacks before you even get to the server configuration. – Xiong Chiamiov Jan 16 '17 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.