Does routing internet traffic via VPN through a company proxy gain any more security?

Question

There is currently an ongoing discussion in our company about what security measures to put in place regarding workstation access to the company network and the internet.

Situation:

• Employees have Linux laptops with encrypted SSDs
• on these SSDs is the intellectual property of the company
• Employees have unrestricted root access to these machines
• AntiVirus is installed and running

Goal:

• Have protection against theft of the intellectual property of the company while still being able to work from anywhere in the world

Current idea:

• Use VPN to tunnel all network traffic (including internet traffic) through the company
• Do not allow direct internet access via VPN but rather enforce that a proxy server has to be used.

Question:

Does the additional proxy server for internet access provide more security than it (potentially) costs in the effort? (additional client configuration effort programs and services, ...)

Laptop <-> VPN <-> Proxy <-> Internet vs. Laptop <-> VPN <-> Internet

Brainstorming:

If the laptop is compromised (backdoor running). How does VPN protect the data anyway if the user has root access and can change network configuration (routes, iptables, ...) as he pleases. What additional security does a company proxy give?

Answer 1

Does the additional proxy server for internet access provide more security than it (potentially) costs in effort ?

If the proxy is just a dumb proxy then there is no additional protection. But usually the company proxy is actually a system which analyzes the traffic for malware or data leakage, blocks potentially malicious sites and might even do HTTPS interception to analyze encrypted traffic. In this case the proxy offers more protection than direct unfiltered internet access from the Laptop.

... If the laptop is compromised (backdoor running)....

That's not the main point of the proxy. The proxy is there to make infections harder in the first place. And it might also be used to detect and block typical C&C communication done by malware.

... if the user has root access and can change network configuration ...

If the user is granted full access to the configuration of the system there is nothing technical the company can do to stop the user from deliberately violating the company policy of using the proxy. But the company can easily check who uses the proxy by looking at the proxies logs and charge users who don't use the proxy with violating the policy.

Answer 2

If they have root access, the security depend on them willing to not:

• disable the VPN
• install non-approved software
• copy anything to external drive
• disable the antivirus protection
• clone the disk to use in another device
• turn the physical device into a VM
• use tar/zip/netcat/ssh and move data outside of the device
• pipe the files through qr-encode and have another computer with a webcam extracting the data

Until you take away their root access, there's nothing you can really do to have a secure station. Even without root, they can start a live OS and do pretty much the same, unless you lock down the bootloader (SecureBoot and the likes).

To have people working from home AND safeguard your data, consider a VDI (Virtual Desktop Infrastructure): create virtual desktops for every employee, host all data inside the company.

Answer 3

Does the additional proxy server for internet access provide more security...?

As far as I know, with just a forward proxy you can black-list and white-list sites, but that's it. A DLP solution is not a proxy, although it can use one in the process.

So yeah, that's the extra security you'll get, which is useless in this scenario since if attackers can get access to the laptop data they have root and can exfiltrate data in fancy ways.

Answer 4

Your employer is running their entire business at "system high", and using the old red-book interpretation of networking. In effect, you're hoping that the firewalls are necessary and sufficient for all things.

That's how the American CIA arranged to have at least one contract sysadmin walk out of the office with their pockets full of all their secrets. Maybe more than one.

It is measurably better than depending on every employee's home firewall, aka "transitive trust", but usually indicates the company doesn't do defense in depth.