0

Let's say we have a private network that is inaccessible without VPN.

Now we want an external service to communicate (e.g. HTTP/AMQP) with the service from our network. As stated in title, it is less secure than hosts inside the network (no regular security checks, etc).

Is there any difference to provide VPN credentials or just adding this service IPs to the whitelist? I mean if external service would be compromised, VPN will not help (I guess).

What is considered a good practice in this scenario?

Improve this question
3
  • What do you want to protect against? Improve security against what threat? If you do not use a VPN, then the traffic from the 3rd party will not be encrypted. Is that a problem? I think you need to define what the VPN is meant to do in your scenario and what a compromised external service means to your service.
    – schroeder ♦
    Commented Jan 28, 2019 at 10:19
  • @schroeder I see. The problem is I'm not familiar with hacking techniques, what is possible and what is not. By threat I meant the possibility to gain access to our private network. Hacking the service itself is less critical. Is it true that nothing except the service can be damaged (assuming all other ports are closed)?
    – AdamSkywalker
    Commented Jan 28, 2019 at 10:35
  • This question will end up being more of a networking question, I think. If the VPN grants the untrusted host access to the network, then the compromised host could access the network. If you only need to expose your service to the untrusted host, then do that.
    – schroeder ♦
    Commented Jan 28, 2019 at 11:03

2 Answers 2

Reset to default
1

As said in a comment, VPN grants the untrusted host access to the network. A quick VPN setup can allow that host to have complete access to all network resources. This is the part you must focus on: providing the access but only for the required service. That service can be seen in multiple ways: access to an IP, to some ports in the network or to even an IP and a single port. So the good practice is to filter this access and only allow the VPN system to access the least possible resources required to perform the job. If a host can only access a port on an IP address instead of a whole network, there's huge security difference.

Improve this answer
0

Does using VPN on insecure host improve security?

Yes, but only when the data is being transmitted.

The role of a VPN is mainly to provide for the confidentiality and integrity components of the security CIA triad. As soon as the data is transmitted from one endpoint (e.g: your private network) to the other endpoint (e.g: the external 3rd party service) in the communication channel , the VPN has served its function. What a VPN would provide protection against are attacks that focus on intercepting or maliciously modifying data in flight such as variants of Man in the Middle - MiTM.

By providing a VPN connection to your network for a potentially vulnerable external 3rd party service, you are essentially expanding your private network to that 3rd party service A VPN is powerless to protect against insecure endpoints or attacks that does not compromise the confidentiality and / or integrity of the data transmission itself. If the external 3rd party service is untrusted, you attack surface is mitigated but can still be significant with a VPN connection to your private network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .