2

During the pandemic I work from home on my own devices via the employer’s VPN. I am aware of the usual privacy risks this represents for me.

My employer used to provide a Server Address, Account Name, Password and Shared Secret to use its VPN. This could easily be configured using the operating system’s own networking capabilities on macOS or iOS.

Recently my employer changed their policy and now requires the use of an opaque tool called “Cisco AnyConnect Secure Mobility Client” to establish VPN connections. Does this tool cause additional security or privacy risks for me when using it on my own devices?

Improve this question
1

Cisco's AnyConnect endpoint agent has a catch-phrase:

Way More Than a VPN

So, the short answer is that, yes, your company IT department may have enabled a range of modules in the software to perform endpoint inspection, DNS filtering, process analysis, remote access, etc.

You need to contact your IT team to understand what modules they have enabled, the privacy impact on your personal devices, and their process for notifying you when/if they make a privacy-impacting change.

They should have provided you with a document explaining all this when they gave you the software to install. Not all companies think of this, though.

Improve this answer
1

Every piece of software that you install on your computer which does not provides the source code should be treated as potentially harmful. In the end, you are trusting (with Administrative privileges) an application to perform some changes in your system. In this case, the software creator is Cisco, which may be considered as a "Trusted" vendor because of its story, however as said, there is no way of actually checking everything that is going on under the hood unless the source code was provided or unless you were a skilled reverse engineer.

Speaking about this specific software, we must not forget that every piece of software could have vulnerabilities and in the case of close source tools the process of discovering/fixing becomes a more daunting task. For example, let's have a look on this zero-day which stayed in the Anyconnect VPN software for 6 months: https://nvd.nist.gov/vuln/detail/CVE-2020-3556

The likelihood of this scenario happening is unusual, although it is valid to bare on mind that even software apparently "Trusted" could have serious vulnerabilities.

Therefore, your concern is correct it is also good to be cautious about what software you install, specially when that software is closed.

Improve this answer
9
  • 1
    The chance of having an unknown vulnerability is overshadowed by the fact that the software can, by design, gather endpoint data.
    – schroeder ♦
    Jun 24 at 11:24
  • 2
    You can read and assess the code yourself as well as a high number of members of the community can, which gives you thousand eyes rather than a small team. Being open provides an easier and faster way of reporting , detecting and solving issues. As usual , thank you for your -1. I loved to help people until I arrived here and met you, honestly.
    – borcho
    Jun 24 at 11:57
  • 1
    How does that help the OP? One should not trust open software either unless they can assess it themselves.
    – schroeder ♦
    Jun 24 at 12:03
  • 1
    1. The user used to connect in a transparent way using the built in tools 2. They changed it to Cisco AnyConnect Secure Mobility Client 3. He asks if the Cisco AnyConnect Secure Mobility Client could cause additional privacy and security risk Since he is installing a piece of external software which he does not know what is exactly doing and which is even worse because it is closed source (even if he wanted he could not) therefore the answer is yes. Installing closed software inherently could cause additional privacy and security risks.
    – borcho
    Jun 24 at 12:08
  • 2
    I'm working with your answer that you have written. Not you, personally, or what you might do, or what your skills are. You said that closed software should be considered potentially harmful, & that open source software allows the OP to see under the hood. This is a gross oversimplification. As I had, the OP would need to have skills to analyse the code. They would need to be a skilled coder for source code availability to matter. That makes the statements in your answer useful in a specific context. You could simply generally state that all software can have vulns & be potentially harmful.
    – schroeder ♦
    Jun 24 at 12:19
-1

In brief, no, there is no reason for it to cause additional privacy risks.

Anyhow, and since you are using your own devices (your employer should provide those), I'm assuming you have admin rights so you could always establish routes to your employers systems through the VPN and different routes through your ISP for your personal use.

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.