0

We have a set of people who need to do a proof of concept for 9 weeks. To do that, they need to VPN to a well known IT company environment.

However, they want to be able to install the IT company's VPN client (which is simply Cisco anyconnect) onto their corporate VDI to do it.

It works, though we had to whitelist the ip's of those using the app on the proxy at our edge. It also means they lose connection to our network once connected to the other company's network.

I need to know what the risks are here as there's a trade off between project timeline, time to set up a dedicated concentrator and resource to do that work. (The IP white list for users would be removed after 9 weeks this ensuring they couldn't use the VPN again)

(Fyi there is a clientless VPN that uses port 443 but apparently it's 'slow')

Can you help?

2
  • Does that VPN allow unrestricted/unmonitored internet access too, or is it limited to WellKnown LLC internal resources? This might be helpful Feb 13 at 9:17
  • Limited - thank you though Feb 13 at 10:25
1

In my opinion, risks are low in this case, unless we start making suspicions on the people involved in the project about insider trading.

I see a potential risk in information exfiltration made by a rogue project member that leverages the VPN's encrypted traffic to access some resource at the IT company (e.g. storage) to later retrieve it (probably the employee will be able to access the same VPN from home).

But since the people on the project are limited in number, it's not my choice to make suspects upon them. Maybe they are trusted enough.

Or if the VPN, as in my comment, also allows for Internet access, different evil may happen. Suppose none of the users are insider traders (rogue), if the VPN allows for internet you are at minimum giving up on antivirus protection from proxy, unless the IT company protects the VPN with a restrictive proxy/filter. This is why you should talk with WellKnown LLC to make sure they block general internet access, of course unless it's really really fundamental for the project.

As you said, you are using Cisco AnyConnect. That is a tool widely used on the market, and as any tool, it shall be installed from trusted source and by verifying the author's digital signature, which is something Windows is good at.

The risk of the AnyConnect binary to be tampered with is negligible unless the company is enough high-profile. By the way, Govern... (I mean, determined-attacker)-level attacks are often out of the scope of this board because it's basically not possible to defend from a determined attacker with unlimited budget forever. AnyConnect needs Admin privileges and can modify system settings, so that's a tool sensitive enough to use care when being installed on corporate machines.

As a side note, stating that "I don't trust Cisco's AnyConnect because it could do malicious stuff" is like refusing to install MS Windows itself after not having verified its source code (which is the reason why Chinese government owns its customized and vetted MS Windows version: protect from potential US tampering).

1
  • Nicely articulated. I reckoned it was something like that but you've started it very succinctly Feb 13 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.