VPN access concerns and security risks

Question

First off, I should note that I am only a user of VPN and not an admin, so my knowledge of how VPNs work is very limited, thus I turn to the VPN gurus at stackexchange to see if you can cast some light on something for me.

I've recently started a new job, where we have a large amount of files on a server that I can access from home/anywhere using VPN.

When I started working here I got a laptop with Windows 10 on it and the VPN access set up using Cisco. However at hime I have a Mac, and when it comes to reading text/PDFs documents etc. I much more prefer the Retina screen of my Mac over that of the thinkpad, and thus I attempted to connect to the VPN server from my Mac.

I soon found out that I needed something called the "Shared Secret" to properly set things up, and that was the only thing I was lacking in order to proceed. I then contacted IT support to get the "Shared Secret" and was declined.

Their argument for declining me were;

1 - "we do not know what people have on their private computers" 2 - "we do not support Macs"

Now, these reasons confuse me. My understanding was that VPNs are set up in a way to allow secure connections in a way that it would remain secure regardless of what applications are installed on my personal computer. Also that it doesn't discriminate between OS.

Do any of you have any inputs to the claims offered by our IT support? I'm not going to take this any further, I am just very curious (I am a data scientist, so I am interested in all of these things, even though I presently know very little).

Answer 1

A VPN is a tool for protecting data in transit. It allows for sensitive data to be passed over an open network, without the data being stolen. Once the data is at the other end of the connection, the VPN's job is done.

This means that if your Mac was allowed to download data from your company network, they can't control what it does with the data. Now, you could argue that they can't control what you do with your work provided laptop perfectly either - maybe they allow USB pen drives, so you could copy data saved to the laptop and put it on another computer, or let you connect to other networks. However, since it's their computer, they can theoretically enforce some rules about what is done on it - and monitor what is done, in some cases. With your own device, it's a bit harder to enforce that. Would you be willing to let them monitor everything you did on your Mac? How about seeing when you looked at your banking details? Or if you got an email from a competing firm?

It's common for VPN access to be restricted to company provided devices, or to devices which are monitored, since it effectively allows for a remote user to act as if they were on the local network (or a subset of the local network, depending how the VPN endpoint is configured - it might allow access to "low security" systems, but not to "critical" systems, for example). It's the same logic behind only allowing company provided devices to connect to the corporate network.

In terms of Mac support, the VPN software might support it, but they might not have the capability to monitor activity on a Mac to the same extent as they do on Windows - this is less a technical issue, and more a knowledge thing. If you've not got any Mac engineers, you won't be able to support Mac computers as well as you can PCs.

Answer 2

My understanding was that VPNs are set up in a way to allow secure connections in a way that it would remain secure regardless of what applications are installed on my personal computer.

Remember that a VPN provides nothing but a secure tunnel to a private network. They set up the VPN client on your work laptop so that you can use the private network of your workplace from home or essentially anywhere else. So using the workplace VPN on a personal laptop is almost equivalent to bringing your own - potentially untrusted - device to work, which is arguably a security risk. (Also see the disadvantages of BYOD.)

The VPN setup is only meant to secure the traffic between you and the private workplace network so that nobody can tamper with your traffic even if you are working from a public wifi or another untrusted network - and nothing else. It helps against an untrusted communication channel but not against an untrusted device. There are no mechanisms that would prevent malware on your machine from accessing the workplace network, extracting VPN authentication information or copying work-related files from your machine. If you are using the provided laptop instead, the administrators will at least have an overview about which devices are at use and can issue security updates/audits accordingly.