3

What are the risks of using an Android phone as a modem to connect my netbook to my company network from outside the office? Is it better to use a cable to connect them both or bluetooth? I've read that using VPN is good enough to protect my data, is that right?

Improve this question

2 Answers 2

Reset to default
7

A few points immediately come to mind:

  1. If you're using a vpn, the medium over which you send traffic is of reduced importance. The whole point of a vpn is to create a virtual distributed private network which uses an untrusted network to transmit traffic. As long as the vpn is properly configured (aggressive mode disabled, strong encryption etc) then it is of questionable importance how you gain access to the wider internet.
  2. If you are using an IPsec VPN then the security features are implemented within the IP layer of the network protocol stack. This means that all layers under this (data link, physical etc) benefit. Therefore if your connection to your bluetooth device occurs at a lower protocol layer, even if it is compromised, an attacker will not gain access to the higher layer (transport, application etc) data.
  3. Regardless of the potential to break the security of your vpn connection, bluetooth is widely considered to be vulnerable to a number of attacks. I'd be suprised if you found a security professional that made anything more than the absolute minimum use of bluetooth for any purposes. If you have a usb cable handy, you may as well use it!
Improve this answer
0

In terms of reasons you don't really have to worry, Toby covered it all pretty well. I think it is still possible MITM or Evil Twin you before you use your VPN so you connect to a hacker's computer, but that is currently up for debate here (How does tunneling actually work?). This would be bad for your company's security, but it is not your biggest worry, because you can avoid MITM via a VPN by connecting before you are attacked. An Evil Twin trumps VPN because it is usually set up long before you connect to it, so your VPN is set up with the malicious network. However, I would note that one rarely sees Evil Twin attacks. The biggest worry is that by some accident you come in contact with a really bad worm or virus. By connecting to your company network you provide the worm/virus with a new series of hosts. Your company could lose huge amounts of data, money, and client confidence, and although I am not a lawyer I would bet that you would be held at least partially responsible. Even if you aren't your company would probably fire you. Please keep in mind that all this is very unlikely, and I agree, on the whole, with Toby. I just wanted you to be aware of the risks as well as the assurances.

Improve this answer

You must log in to answer this question.