3

My company wants to move an internal web app to the cloud. The app only accepts SSL/TLS connections and requires all users to authenticate using our Single Sign-On provider.

Today when a user wants to access this internal app remotely, they connect to our corporate VPN. So the current plan is to configure a site-to-site VPN connection between our office and the cloud provider.

My personal impression is that whitelisting our office's IP with our cloud provider would basically provide the same level of security. Everybody tells me that I am wrong but fails to give me a convincing argument.

My thinking is the following:

  1. Site-to-site VPN does not authenticate individual users or machines, it only guaranties that the traffic only flows between two networks (our office and our cloud provider). If the source of the traffic is restricted by its IP and the destination is authenticated by its valid SSL certificate, isn't it the same?
  2. The encryption provided by the VPN is redundant since we already use TLS.
  3. If anything, the VPN option is less secure since it could let in incoming connection from the cloud provider which we do not need nor want.

The main argument that I've heard is rebutting point #1 on the basis that IP whitelisting is not secure because of IP spoofing. My understanding is that IP spoofing is basically only used in DoS attack and that an attacker would not be able to complete a TLS handshake while faking it's IP (see this question for details).

Am I missing something here?

  • You're assuming the connection is unidirectional (from the user browser to the web server). Maybe that's not case, and the application needs access to internal services (AD or file server, for example). In this case, the VPN makes a lot of sense. – Najkin Feb 5 at 12:04
  • 1
    @Najkin I know for a fact that the application does not need incoming connections, I coded it. That's why I am saying in item #3 that bidirectionality is actually more of an argument against the VPN. – asking_for_a_friend Feb 5 at 14:45
0

Site-to-site VPN does not authenticate individual users or machines, it only guaranties that the traffic only flows between two networks (our office and our cloud provider). If the source of the traffic is restricted by its IP and the destination is authenticated by its valid SSL certificate, isn't it the same?

That is true, VPN in this case does not authenticate individual users or machines, however, it offers a defense against MiTM attacks, since impersonating one point of VPN site-to-site network would require a considerable effort.

The encryption provided by the VPN is redundant since we already use TLS.

True, but I doubt that VPN was selected because of encryption (assuming)

If anything, the VPN option is less secure since it could let in incoming connection from the cloud provider which we do not need nor want.

True, but in the same manner neither is IP whitelisting is secure, as it will allow traffic flow from provider.

There might be more to it than you've described, for example Network Administrator thinks that it we be easier for him to manage such connections by putting them on VPN, or maybe you company uses different devices for VPN access than a firewall for example, and want to offload traffic burden from firewall.

| improve this answer | |
0

While your assumption #1 is true, whitelisting your corporate IP means that anybody in your company can have access to that application, even though they might be blocked by the SSO. Using a StS VPN helps here because you can use subnets and only allow people in specific subnets to have access to the application.

Also, if you have a corporate WiFi and a guest wifi, whitelisting your corporate IP would allow ... guests, to have access to that application.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.