Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I understand the need to use a VPN when connecting to public wifi. I also understand the need for a VPN when connecting to the company's internal network. However, I am less certain about the benefits of using a third-party VPN (NortonVPN in this case) when working from my home network. My employer is under the impression it is not safe to work from home without using NortonVPN.
Are there valid technical reasons to require a third-party VPN when working remote?
However, I am less certain about the benefits of using a third-party VPN (NortonVPN in this case) when working from my home network. My employer is under the impression it is not safe to work from home without using NortonVPN.
Are there valid technical reasons to require a third-party VPN when working remote?
If your employer requires\advises it's employees to use VPN in order to access to work environment, even if it's simply accessing an admin panel to a publicly published website, then they have a valid point.
All your data going to the endpoint, pass through network\application of your network provider, and anywhere in-between it can be intercepted. Even https traffic is not safe, since simply deploying a proxy which requires download and installation of it's SSL certificate is enough to decrypt and view all the data you are exchanging with the endpoint.
Using third-party VPN solutions however may not be the best solution. They can be susceptible to the data leak, and it might be too late to discover that. Besides, there are no guarantee that third-party VPN vendors are absolutely self-conscious about the data that passes through them. It would be best for employer to use there own, internally deployed VPN solution.
In short - Using VPN for work, even from home is a must. Using third-party VPN for these purposes cannot be sufficiently justified.
The purpose of VPN for access to your workplace is to secure your traffic from eavesdroppers on the network where your endpoint device resides (e.g. your home WiFi or the neighborhood coffee shop). This is critical where you are handling proprietary data, and is also important when you come to authenticate yourself to your employer's systems to do work (to ensure you aren't being impersonated by someone sniffing your traffic locally).
The difference between a third-party VPN such as NortonVPN and a VPN provided by your employer is at the other end of the connection: while employer-provided VPN terminates inside your employer's network perimeter, third-party VPN must terminate on the public Internet unless there is a working relationship between the third party and your employer.
The advantage of third-party VPN in this case is the employer doesn't need to purchase or lease expensive equipment for VPN termination, but instead the third party spreads that cost over many customers including your employer or yourself. However, third-party VPN works best when your employer's services are exposed to the public Internet and are protected by controls at each step, as opposed to when services are exposed only inside a perimeter firewall and relying on that firewall to keep bad things out. This favors cloud-based services over on-premises services, and your employer will likely have done the risk analysis to justify this.
