1

I saw a few breaches on a very large scale where an organization like JP Morgan suffered a huge breach just by allowing their employees to connect via VPN to their machines at work. Seems that hackers took over JP. Morgan employee computer to connect to his machine at work. Usually, employees connecting to their desktop at work via VPN program that been developed by a company, 2FA and of course they use their own protection measure like a reverse proxy in the backend. I was trying to understand how a company like that could be hacked and what are the possible measures to take for such organizations.

Link to JP. Morgan Study: https://www.sans.org/reading-room/whitepapers/casestudies/minimizing-damage-jp-morgan-039-s-data-breach-35822

Improve this question
1
  • 1
    Does your scenario use a VPN client that sends system status to the server to decide if the system is clean enough to connect? A VPN itself doesn’t say much, it’s all about the policies.
    – John Keates
    Aug 12, 2018 at 6:34

2 Answers 2

Reset to default
2

From wikipedia:

A virtual private network (VPN) extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network.

The situation you describe is no different from me taking my gaming PC (which is undoubtedly full of viruses), bringing it to the office, and plugging it into an ethernet cable. Happy happy viruses now spreading through the corporate network :)

That's why companies prefer to issue corporate laptops over which they can enforce virus scans, etc, and only allow those to connect to the corporate network (whether wired, wireless, or vpn).

(it is possible to do personal-computer-vpn securely, but it's a fair bit more complicated -- you vpn in to a landing subnet from which you can access DMZ'd VDI / RDP hosts, from which you can access your work machine, or something like that. But even there, your personal computer may have keyloggers collecting your corporate passwords and other things you type.)

Improve this answer
1
  • Or you can run Linux on your personal laptop, or use a Mac, and Windows viruses (the majority of all malware that spreads) won't affect you.
    – Dev
    Oct 25, 2018 at 22:58
2

Should they? The answer is complex.

With a completely unmanaged machine? I don't think the risk is worth it, so no.

With a machine that has to have a corporate approved security policy? Yes. But this is also complex, it is a personal- non corporate machine so why should I let corp put AV, patch and a screen lock on it? Oh, because I am connecting to a work network. But not all employees see it that way.

Connecting to a desktop using a tool like RDP can be done safely, for example you can use a GPO to block file transfers and require 2FA as a start.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .