1

As per the question what are the risks?

if we did go ahead with this and some of our users installed a supplier's VPN client on to our corporate machines, once the connection is establish can a threat actor from the supplier use that connection to jump on to our company network?

The other risk i see is that there is a tunnel created from a user desktop straight to the supplier network, possibly bypassing all our corporate boundary controls such as firewalls etc. What other risk should i be aware of?

4
  • Are you asking about the risks of the client or the risks of setting up a VPN? Those are different classes of risks.
    – schroeder
    Jun 30 at 14:56
  • i am talking about both as they go hand in hand. You need the client to setup the VPN. Jul 1 at 8:59
  • Your comment to the answer below suggests that they are not hand-in-hand. If you are concerned about the VPN itself, then you need to describe how the VPN is set up and what controls it has. You do not mention anything about this, just the client program.
    – schroeder
    Jul 1 at 9:05
  • i mention vpn client as this enables the VPN connection. The VPN client is just a piece of software with the digital cert . The VPN is just an encrypted private connection over the internet to the supplier. My question is still the same. What are the risks when this connection is established and what controls should be considered. Jul 1 at 9:21
1

A 3rd party supplier is asking us to install their VPN client onto our corporate machines to enable access to their environment

Rather than install a piece of software on multiple machines, I would prefer to set up the VPN using a dedicated box in your network (if possible), to grant your users transparent access. It depends on the vendor solution. But your existing router/firewall might even be capable of handling the VPN link. This is likely if were are talking about a common software solution such as OpenVPN or Wireguard. For proprietary solutions the options may be more limited.

If you are going to install software you need to think about maintenance. Updates. Unpatched software is software that can be vulnerable. Just think about it, in recent weeks Pulse Secure has suffered multiple flaws, emergency patches were released but some companies still got hacked. Fast reaction is even more crucial when 0-days are released into the wild.

once the connection is establish can a threat actor from the supplier use that connection to jump on to our company network?

Possibly. Normally the other party should only have access to a single IP address or a limited range. It is up to you to define the requirement, and enforce it. You can use VLANs for segmentation. At least that's the idea when using hardware for the network interconnection. In fact the other party could be more at risk, since you will be initiating the connection to them but the tunnel goes both ways.

But it's difficult to achieve isolation if you install software straight onto the workstations. I wouldn't take this route personally, and I suspect that the other party is simply proposing you a simple and easy solution that works in a few clicks, but security is an afterthought.

2
  • We have a jump box. Would a possible solution be for a users to RDP onto this jumbox (its Win server 2016), setup the VPN client, and from there users access the environment? Or another solution is to setup site to site VPN? or is this overkill for just a couple of users? The dedicated box you mentioned, would that need to be in a DMZ? Jul 1 at 8:56
  • "Possible" in what definition of possibility? It will depend on the 3rd party if it would work. Same for site-to-site. If this is just for 2 users, don't you think that would be an important consideration for any conversation about risk?
    – schroeder
    Jul 1 at 9:09
1

Well its a VPN Client. It needs interaction from your users to connect to vendors network. So it would be good practice to not set it on autostat but train your users to only start it when needed. Most vendors provide an integrated launcher in such cases, a programm that starts the VPN connection and then connects to the service.

So, from my perspective, its more transparent and safer than a jump box or a dedicated router from the vendor that is integrated into you network.

It is possible to have access via this VPN but this would require the threat actor to have access to the vendors network beforehand. If you deem this a realistic risk, you should reconsider you vendor choice.

The biggest risk comes from some "custom" version of some standard VPN client which gets no security updates from upstream.

Controls are pretty standard in those cases, only connect when needed and keep the software up to date.

3
  • 1
    I started an answer then realized you had already mentioned my immediate concern, "their VPN client". Perhaps it's just loose phrasing but if not, I would be extremely leery of a non-standard client. I can think of no reason not to use a standard vetted client, and many reasons to avoid a custom client. Jul 3 at 18:55
  • Yeah, but they are all too common and you loose support if you use the standard client instead of their own. Jul 3 at 18:57
  • The VPN client is from a well known vendor. Jul 5 at 7:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.