Securing Client-Server Architecture with VPN or a SSL-connection?

Question

I developed a mobile application that runs on our company's mobile terminals. The mobile application connects to the company servers via GSM network.

We had a meeting to decide how to secure the communication between mobile application and server application. Our security team insists that we must install a VPN application on the mobile terminals, connect to our company network with VPN firstly and then our mobile application should connect to the server via https.

I could not understand their insistence. I think giving VPN rights to every mobile terminal owner is more dangerous than securing a connection with https. As I know, https connection could provide required security between client and server applications which I wrote both of them and they use https for communication.

Is there any security related information that my knowledge is not enough to understand? If I am right , how I could show them that https is enough for security and giving VPN is more dangerous. Any other convincing information is welcome.

Answer 1

The main advantage of a VPN over a simple TLS connection (which HTTPS is) is that the VPN authenticates the client. TLS can do this as well; just use mutual TLS (TLS with client certificates), which nearly all TLS server and client implementations (including HTTPS servers and clients) support. Create and install a unique client certificate (with a unique private key, and the cert signed by an internal CA) on every mobile terminal, and you can use that to provide the same level of client authentication as a VPN. You can then use the client certs to tell which terminal is connecting, before they even send any HTTP traffic.

Another advantage of a VPN is that it can collect all traffic from the host, not just from one application. However, if you don't care about traffic from other applications (ether because they don't exist or because you don't want them routing through your servers anyhow) and the application itself is well-audited to ensure it never establishes a HTTP connection instead of an HTTPS one, the VPN provides no value in this way.

Other things a VPN can provide:

• Client security / health checks... but those can be spoofed anyhow, because it's impossible to write a client that cannot be spoofed (although, for DRM purposes, much effort has been spent on finding ways to make spoofing hard).
• Concealing multiple streams of traffic (such as multiple UDP or TCP/HTTPS connections) within one connection. If you care about this, you'll need to use VPN or another tunneled connection, yeah.
• Concealing and securing DNS queries, which are otherwise sent in plain text and can be tampered with. Assuming you care about your adversaries being able to tell what DNS requests you're making - which you probably don't; if your VPN tunnel is only used for one thing then that's as good a level of information to an outside actor - this is a risk, but it can be mitigated by just storing the domain name -> IP mapping locally (perhaps in the device's HOSTS file) or by using DNS-over-HTTPS (which is new and may not be supported by your DNS client yet, but is available now through some providers). Alternatively, you can set up (and require) DNSSEC, but that only prevents tampering with the response, not an eavesdropper seeing what site you're requesting.

Answer 2

CBHacking's answer is completely accurate regarding the benefits of VPNs. However, I do not believe it addresses your question of "does allowing VPN access to mobile devices increase risk?"

You may have valid concerns. Depending on the type of mobile device, it may be a mobile phone that could be lost or stolen, or a industrial-type/other device that is installed and left alone for long periods of time.

In either scenario, an adversary could gain physical access to the device. Not only can they access your application, but they could also probe the network at the other end of the VPN. The risk is that you could have an attacker sitting on your internal network, from many miles away.

That said, your question doesn't really specify details about the VPN. The ideal solution would be to create a new VPN server dedicated to this purpose. The VPN server would only allow the mobile clients to connect to internal company services that are absolutely required, and it would isolate them from the VPN used by employees.

If it is the same VPN that employees use to work remotely, this is still possible to do safely. The mobile clients should be forced to a pool of IP addresses, for which the VPN server should apply firewall rules to, accomplishing the same as above. Depending on the VPN server, it may or may not be possible to allocate addresses depending on the identity of the client.