16

My employer issues a list of security recommendations when using a work laptop outside of the work network. The security recommendations are related to such risks as data theft, viruses, or other unauthorised access. Most recommendations I understand, but this one surprised me:

Never connect simultaneously to two different networks (for example cable and wifi), in particular not when you are connected by VPN to [employer network].

Is there a security risk of connecting both by cable and by wifi simultaneously? Does VPN make this worse? Or is this recommendation not directly useful?

Improve this question
2
  • 1
    by "cable" they are referring to a physical Cat5/6 cable, right? Not cable internet?
    – Conor Mancone
    Feb 12, 2020 at 14:01
  • 8
    @ConorMancone I think they mean a Cat5/6 cable, not cable internet. I'm translating from German, where it says z.B. Kabel und WLAN.
    – gerrit
    Feb 12, 2020 at 14:04

4 Answers 4

Reset to default
27

The risk is not really for your own system but for the corporate network. I assume that the private network is only connected to internet through a secured firewall, and that through the VPN you get access to that private network.

If you manage to have your machine connected at the same time to a public network and to the VPN, it will constitute a new connection for the private network bypassing the main firewall. This is something that any security team sees as a terrible config: an external attacker could get access to the private network through your machine without hitting the firewall, and with no possibility for the sec team to have any trace of it.

Do not worry about it: this recommendation is common as soon as you get a corporate VPN.

Improve this answer
10
  • 21
    You can't connect to a VPN without also being connected to a public connection. Some VPN setups for companies don't even force all traffic over the VPN once connected to it. And any VPN I've used for work has always run through the firewall, either because the appliance IS the firewall, or it's outside of the firewall.
    – Logarr
    Feb 12, 2020 at 22:45
  • 3
    @Logarr, unless split tunneling is used (the statement in the original question indicates that it is not), a VPN service will route all traffic (except for the tunnel traffic itself) through the tunnel. Having a second connection can provide the same security risks as a split tunnel. While often the VPN end point is a firewall device and may run through a firewall, it isn't the same stringent firewall that outside traffic is required to traverse as it is treated as some sort of "trusted" connection. If it was treated as outside traffic, there would be no need for using VPN in the first place.
    – YLearn
    Feb 13, 2020 at 5:34
  • 3
    Yet, given it's a work laptop, with a corporate antivirus and routing disabled, an attacker could not use that laptop to access the corporate network. If the laptop was compromised, they could equally have established a route to them bypassing the VPN. To me this seems like an extreme measure that mostly serves to inconvenience users that may need to hop on and off the wifi connection. Besides, it's really hard to enforce and to remember: so if they don't want employees to use two connections simultaneously they should better enforce it via a software policy.
    – jjmontes
    Feb 13, 2020 at 9:27
  • 1
    It is strange that one network is okay but two are not. But it's probably a limitation of the VPN software.
    – user253751
    Feb 13, 2020 at 10:28
  • 1
    @benxyzzy, so, let's say your browser gets infected by J. Random Drive-By Download, which tries to connect to a command-and-control server when it runs. If your corporate VPN routes everything except the VPN traffic itself through the VPN, and the corporate firewall blocks access to that CnC server, the malware will be prevented from taking effect while your VPN is active, stopping someone tunneling in over that CnC connection from getting to corporate resources that aren't on the laptop itself. Still let Internet traffic go out through the Internet? Then corporate tools can't block it.
    – Charles Duffy
    Feb 13, 2020 at 20:41
10

Depending on your routing table (corporate laptops may have defined route table entries), settings in your network adapters, having or not having a perimeter firewall which filters traffic for VPN users, IPS or IDS, when you connect to any two networks (cable + wifi, cable + hotspot ad hoc) (cable + cable) (bridged) (if network is setup as shared) the hosts from both network may become routable to each other, creating a security risk as in being able to receive and send packets between these 2 networks.

This means, that even if you have some kind of EPS (endpoint protection software) thanks to which your network trusts your laptop, having these 2 network in aforementioned configuration, the requests coming from untrusted hosts may be treated as trusted, because they would appear as requests from your laptop.

If the connection is not bridged, then even after connecting and having problems in routing that allows passage of packets between 2 networks, there are nothing to worry. Because at the very basic, the perimeter firewall that allows VPN connections, should deny packets from IPs that are not originating from VPN client.

Improve this answer
3

The corporate network is almost certainly segmented into multiple zones or security areas. Between them are firewalls and/or other security systems to control access to those areas.

If you connect a machine that is not a properly configured security device to two networks at the same time, you are creating an uncontrolled bridge between these two networks. Possibly networks in two different security zones. Someone who managed to penetrate into the less secure zone, but could not (or not yet) penetrate the security systems to get into the more secure zone can now use your computer as a bridge into that zone, circumventing the security systems that your IT has built and carefully configured.

In the worst case, you are connected to a public network (an open WLAN or an Internet Cafe, etc.) on one side, and a secure zone deep inside the corporate network via VPN on the other, defeating multiple layers of security.

Improve this answer
2
  • 1
    I thought that if I connect to VPN, then all traffic should go via VPN, even if I am (for example) connected by CAT5 with one network, wifi with a second, and WAN/LTE to a third? Am I wrong?
    – gerrit
    Feb 13, 2020 at 8:20
  • 1
    Yes you are wrong, it all depends on how the VPN sets up its routing tables. One VPN I'm using, for example, routes all 10.x.y.z (10/8 in netmask terms) traffic through the VPN, because the company that provides the VPN uses a 10/8 network internally, but nothing else. Standard internet access doesn't ever see the VPN or their servers.
    – Guntram Blohm
    Feb 13, 2020 at 9:18
1

Most corporate VPN clients (by means of firewall and routing rules) intentionally insulate your computer from all other networks you may be connected to, when connecting to the corporate VPN. This is done in order to prevent your computer from being used as an intermediate for connecting to your corporate network from outside.

When you connect to more than one network, it is up to your computer's operating system to determine which network to use for outbound connections (including the VPN connection itself) AND to change it's mind whenever it feels like. Such a change may:

  1. Break your VPN connection leaving your communication unprotected (a sane VPN setup will prevent any further communication to the corporate resources, but one can never be sure)
  2. Instate different firewall/routing rules that can leave your computer able to connect to both the corporate VPN and the unprotected network at the same time. This may enable a malicious actor, by using some unknown or unpatched vulnerability in your computer, to gain access from the unprotected network to the corporate one.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .