There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet.
Situation:
- Employees have Linux laptops with encrypted SSDs
- on these SSDs is the intellectual property of the company
- Employees have unrestricted root access to these machines
- AntiVirus is installed and running
Goal:
- Have protection against theft of the intellectual property of the company while still being able to work from anywhere in the world
Current idea:
- Use VPN to tunnel all network traffic (including internet traffic) through the company
- Do not allow direct internet access via VPN but rather enforce that a proxy server has to be used.
Question:
Does the additional proxy server for internet access provide more security than it (potentially) costs in the effort? (additional client configuration effort programs and services, ...)
Laptop <-> VPN <-> Proxy <-> Internet vs. Laptop <-> VPN <-> Internet
Brainstorming:
If the laptop is compromised (backdoor running). How does VPN protect the data anyway if the user has root access and can change network configuration (routes, iptables, ...) as he pleases. What additional security does a company proxy give?