Whitelisting DNS vs. Packet filtering Firewall

Question

I am an information security intern for a MSP.

The company is set up to work remotely a few days a week. As I was gathering information for the assessment, I found out that one of the employees does not have a packet filtering firewall. She is running a Cisco Umbrella DNS agent and an SSL VPN when working remotely. She is adamant about telling me that she does not need a firewall because of the DNS agent and SSL VPN.

I always learned it was necessary to have a perimeter firewall to manage traffic. How can I articulate why she needs a firewall along with the other security controls?

Answer 1

I assume she expects that Umbrella will protect her from any unauthorised outbound connections because Umbrella whitelists common domains and blocks suspicious domains. A firewall also protects the machine from outbound connections.

The problem with Umbrella is that it only works on domains and not IPs. If malware on her machine is configured to reach out to an IP, Umbrella will do nothing.

Umbrealla will also not protect her from incoming connections, although that risk might be minimal if she is not running any services that can be connected to.

Answer 2

As we don't have the full picture of what the infrastructure looks like this is non-trivial to answer.

To clarify the situation I would suggest checking how the VPN tunnel terminates on the enterprise infrastructure. Very likely it is either terminating directly on a new-gen firewall (that does packet but also stateful inspection acting as IPS/IDS) or the traffic flows through a DMZ into the corporate network with the mentioned IPS/IDS (firewall) in between. The presence of Cisco Umbrella DNS is an indicator that a firewall is present somewhere in the remote VPN flow but you would have to clarify with the respective Network or Security team(s).

Answer 3

Point 1: If you have organizational policies on 'End Device Protection' and 'Remote Access', it's matter of explaining to your employees and explain them the mandate to follow organizational policies. For example if your policy states all your user devices need to be installed with 'Packet Firewall', all your employees have to follow the policy.

Hence If your idea of implementing Firewall is accepted by your policy makers, please mandate this on your organizational policies.

Point 2: Impact of having a Firewall at end device is based on the infrastructure setup you have and the way you allow remote connectivity. Hence it would be subjective answer but you may implement following to mitigate risks:

1. Implement IPS Sensors/DDoS Sensors on the gateway where the remote users connect
2. Control the access of remote users to specific hosts/access
3. Monitor the activities of remote connection through SOC
4. Etc