0

I've recently become the "tech guy" at a startup, and am tasked with standardizing our hardware infrastructure. Further more, I choose how employees working from home will connect to business hardware. I am not a security expert, although I do know some things here and there through life experience as a developer and computer nerd. I would like to validate (or invalidate) some ideas with your community.

I'm thinking that business hardware can be considered secure in a private network behind a firewall, whereby all incoming/outgoing connections are done via VPN. I'm under the impression that this is in general sufficient for a private network's safekeeping.

What I'm more worried about though, are employee PCs. I'm currently considering a VNC client that connects through an ssh tunnel (while also connected to the vpn). I'm not really sure this is sufficient though. Will a VPN protect the ssh connection from malice? Do I need an employee-pc firewall in addition to VPN to keep it hidden? Do I need to even care who can see the ssh tunnel if its accessed by public/private key? These are questions I have gut feelings about, but can't answer with certainty.

Maybe better worded: how would you connect an employee PC to business hardware securely such that business hardware/software/data are safe and hidden?

Any guidance would be appreciated.

1

I'm thinking that business hardware can be considered secure in a private network behind a firewall, whereby all incoming/outgoing connections are done via VPN.

The assumption that the business hardware has no connectivity apart from the VPN cannot be made in all environments. In some cases there is some form of captive portal which require non-VPN access first. There might also be polluted DNS caches or use of local DNS server. See this talk (presentation and white paper) from Blackhat 2020 for more.

What I'm more worried about though, are employee PCs. I'm currently considering a VNC client ...

This is even more tricky and there are a variety of approaches with different risks.

The most secure version is probably to temporarily take full control of the computer, i.e. essentially make it "business hardware". This can be achieved by booting an alternative OS from an external medium, typically a USB stick. To do this often some pre-configured Linux system is used. There are also companies which offer products based on this idea.

Mostly secure is also some kind of remote desktop, i.e. virtually sharing screen, keyboard and mouse (and maybe audio and local printers) with some remote computer or VM in the company, for example with protocols/applications like VNC, RDP, NX or even from within a web browser. One commonly exploited weakness here is the access control, i.e. such systems or often accessible from the internet with either no or weak passwords or the credentials can be retrieved with the help of very common phishing mails or if the access is used from a compromised system. Thus it is strongly recommended to have some kind of 2FA/MFA in this case.

Tunneling the remote desktop protocol inside some VPN and/or SSH can reduce the weaknesses of the protocol itself (like no or bad encryption, or bugs like this) and can also add additional authentication on top. It does not by itself reduce the risk of compromised credentials, so 2FA/MFA is still recommended.

Additional weaknesses with this approach occur if the client system is somehow compromised. Apart from grabbing the login credentials it can also do screenshots, hijack keyboard and mouse, make use of weaknesses in the sharing implementation for example by attacking channels for sharing audio or printing.

Less secure is the option to simply install a VPN client on the users system. Assuming that the users system is compromised this essentially allows an attacker an easy way into the company network.

And then there is the option to providing only limited access to specific applications, instead of to the full computer and network in case of RDP or VPN. For example it might be possible to limit access only to mail and to some specific business applications. Apart from access to applications which are in the cloud anyway (i.e. Microsoft 365, Google Workspace etc) various companies (like ZScaler, Cloudflare, Akamai) also offer limited connectivity to company-internal applications this way and also offer protection of the web traffic. To prevent credential phishing 2FA/MFA is recommended here too.

1
  • I appreciate your comprehensive response very much. I have been considering a "make their computer business hardware" approach, either by a bootable drive or by sending over a full computer (not that it's practical, but it's an idea). Limiting how the computer that connects to the private network can be used feels like the considered-optional-by-many-but-still-important step. I was also leaning toward 2FA/MFA, so I'm glad to hear support for its efficacy. I haven't read your links, but I'm about to now. Thanks again. – AnthonyMonterrosa Dec 13 '20 at 18:21
0

I'm thinking that business hardware can be considered secure in a private network behind a firewall, whereby all incoming/outgoing connections are done via VPN.

This is an older concept in Information Security. It’s referred to as a boundary model. Some would say this is archaic. Modern forms of architecture are based in zero trust models.

I'm under the impression that this is in general sufficient for a private network's safekeeping.

And that depends on MANY things. What type of data do you have? What types of threats are you protecting your data from? What are the risks to your data? What is the size of the company? What is it likely to lose if there is a data breach? BTW, don’t publicly answer the questions I asked...

I would handle personally identifiable information differently than I would handle company secrets. Is there medical information to consider in your network (like what Human Resources might access)? Is there scientific data that may be controlled in some way? Is there financial data? What are the legal requirements for what you are doing?

What I'm more worried about though, are employee PCs.

It sounds like you want to allow business PC’s, but prevent employee PC’s from connecting to the network.

I'm currently considering a VNC client that connects through an ssh tunnel (while also connected to the vpn).

So you’re having a system connect to the business network using a VPN Then you’ll have VNC access through SSH. How does that prevent someone at home from installing a VPN client on their home PC, installing a VNC client on their home PC, installing an SSH client on their home PC and...

Turning on the VPN client and logging in using it, then turning on the SSH client, building the SSH tunnel, and then running the VNC client across the SSH tunnel?

If your answer is certificates, it doesn’t take long to find out where certificates are stored, export them, and send them to an email address or dump them on an external drive.

I'm not really sure this is sufficient though. Will a VPN protect the ssh connection from malice?

An SSH connection can be used on its own as a VPN. It does the same job (encrypts traffic end to end). Putting one inside a VPN is essentially a VPN inside a VPN.

Do I need an employee-pc firewall in addition to VPN to keep it hidden?

A firewall doesn’t “hide” VPN traffic.

Do I need to even care who can see the ssh tunnel if its accessed by public/private key?

Well, that depends. Putting the SSH tunnel inside the VPN tunnel allows the traffic to be encrypted once it exits the VPN tunnel inside the business network. This means that people inside the business network (sitting between the VPN entry point and whatever server you are having people SSH to, you have to have an end point for SSH) will only see encrypted traffic. Without SSH (in the days of TELNET) logins and passwords were sent in clear text. SSH is meant to mitigate this vulnerability.

These are questions I have gut feelings about, but can't answer with certainty.

You’ve asked a LOT of security questions. What you don’t have is something that deals with the vulnerability you are concerned about. There are many ways to handle this. Some require multiple steps. You really are in over your head at the moment. I say this with almost 3 decades of experience (check other questions I’ve answered on this board), education, and certifications.

What should you do? Recommend bringing in a contractor. Someone you can work with and learn from while you are putting security in place. Then go take some classes. There are LOTS of free videos on YouTube on Security basics. They are a good place to start as well.

Let me know if you have further questions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.