0

I worked for some companies that recommend cutting the VPN connection when not needed anymore while working remote. The VPN is just required to access internal sytems.

Nobody could tell me why, besides "lowering load from the company servers".

Are there any security concerns that came to your mind when using a VPN in a work related use case i.e. to access work files?

8
  • That question is poor on details which are needed to have enough context. What kind of VPN (i.e. real network connection where the local computer is essentially part of the company network or only access to specific services or only some kind of remote desktop), what happens if the VPN is stopped (no connection to anything vs. unrestricted connection to normal internet possible), is this a company or privately owned/managed/used system? Apr 26, 2020 at 19:40
  • @SteffenUllrich good point. I added it. I forgot to mention the "when working remote"
    – flor1an
    Apr 26, 2020 at 19:42
  • "I added it." - practically none of the details I've asked for where added to your question. Apr 26, 2020 at 19:47
  • 1
    "Well its a VPN connection ..." - while VPN should be a clear term unfortunately several products are marketed with this term which are not a real VPN but a proxy or a remote desktop, that's why I asked. So if I understand you right this is some (private or company managed?) system which has unrestricted access to the internet and which provides network level access to the companies internal network, thus essentially "bridging" unrestricted und insecure internet access into the companies network, i.e. some attacker on the internet could access the companies network through your machine. Apr 26, 2020 at 20:01
  • 1
    For more about this read about risk of split tunneling vpn. Apr 26, 2020 at 20:20

1 Answer 1

2

I assume you mean cutting the VPN from the client side, i.e. logging out of your VPN session.

Your VPN tunnel gives you access to servers which you normally do not have. This could be the file share you mentioned, an internal mail server, and so on. But this access is not limited to you as a person, but to the system establishing the VPN connection. This means, that an attack or a malware taking over your system has the same access. Leaving the VPN connection open longer than necessary, exposes those internal systems to a potential attacker. Therefore, cutting the connection when not needed, reduces the attack surface.

This also works the other way round. If a VPN endpoint is only required temporarily (e.g. a service access point for a third party), you should disable VPN access on the server side, when no one needs to log in. Again, the principle of reducing the attack surface guides us here.

3
  • This argumentation makes sense for a system which is used both for private internet use and for being part of the company network through a VPN - which is a bad idea from start. For a system which should only be used for company purposes it could actually be harmful to be not connected to the VPN and thus be protected by the companies security policies and appliances but instead have unrestricted and likely less secure internet access. Apr 26, 2020 at 19:45
  • I see, but the attack surface is only given, when someone (meaning not me) is able to access my laptop right? See the point in this case, but when not?
    – flor1an
    Apr 26, 2020 at 19:45
  • 2
    @user1234 malware can be on your laptop, too. Not just a "person"
    – schroeder
    Apr 26, 2020 at 20:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .