A 3rd party supplier is asking us to install their VPN client onto our corporate machines to enable access to their environment, is this a good idea?

Question

As per the question what are the risks?

if we did go ahead with this and some of our users installed a supplier's VPN client on to our corporate machines, once the connection is establish can a threat actor from the supplier use that connection to jump on to our company network?

The other risk i see is that there is a tunnel created from a user desktop straight to the supplier network, possibly bypassing all our corporate boundary controls such as firewalls etc. What other risk should i be aware of?

Answer 1

A 3rd party supplier is asking us to install their VPN client onto our corporate machines to enable access to their environment

Rather than install a piece of software on multiple machines, I would prefer to set up the VPN using a dedicated box in your network (if possible), to grant your users transparent access. It depends on the vendor solution. But your existing router/firewall might even be capable of handling the VPN link. This is likely if were are talking about a common software solution such as OpenVPN or Wireguard. For proprietary solutions the options may be more limited.

If you are going to install software you need to think about maintenance. Updates. Unpatched software is software that can be vulnerable. Just think about it, in recent weeks Pulse Secure has suffered multiple flaws, emergency patches were released but some companies still got hacked. Fast reaction is even more crucial when 0-days are released into the wild.

once the connection is establish can a threat actor from the supplier use that connection to jump on to our company network?

Possibly. Normally the other party should only have access to a single IP address or a limited range. It is up to you to define the requirement, and enforce it. You can use VLANs for segmentation. At least that's the idea when using hardware for the network interconnection. In fact the other party could be more at risk, since you will be initiating the connection to them but the tunnel goes both ways.

But it's difficult to achieve isolation if you install software straight onto the workstations. I wouldn't take this route personally, and I suspect that the other party is simply proposing you a simple and easy solution that works in a few clicks, but security is an afterthought.

Answer 2

Well its a VPN Client. It needs interaction from your users to connect to vendors network. So it would be good practice to not set it on autostat but train your users to only start it when needed. Most vendors provide an integrated launcher in such cases, a programm that starts the VPN connection and then connects to the service.

So, from my perspective, its more transparent and safer than a jump box or a dedicated router from the vendor that is integrated into you network.

It is possible to have access via this VPN but this would require the threat actor to have access to the vendors network beforehand. If you deem this a realistic risk, you should reconsider you vendor choice.

The biggest risk comes from some "custom" version of some standard VPN client which gets no security updates from upstream.

Controls are pretty standard in those cases, only connect when needed and keep the software up to date.