My company began allowing remote access work during lockdown, and still allows a limited amount of it. Originally, those of us with a sufficient computer at home were allowed to install the company-provided VPN on our home computers, then connect using RDP from the home computer to our work computer still physically plugged in to the company network. Now they are talking about requiring anyone who works from home to bring their work PC to their house and use it for doing the remote work.

I understand that an infected home PC connecting to the VPN could potentially transmit malware to the company network, but the proposed “solution” doesn’t seem any safer to me. Since I must plug my work laptop into my home network in order to get online and VPN back to the office network, wouldn’t that make the work laptop--and thereby the work network--vulnerable in much the same way?

Is this really any more secure, and if so, how is it better?

  • A compromised computer and an untrusted network are 2 very different things. Why would the work computer be at risk from the home network? How would your home network gain access to the VPN? What threat are you seeing?
    – schroeder
    Jan 25 at 20:54
  • @schroeder Presumably, if my home PC is infected it could transmit malware across the VPN to a work computer. If my work computer is on my home network, my home PC could still transmit the infection to the work computer (they're now on the same network, after all) which could then transmit it to something on the work network via the VPN. Seems to me it's the same threat, just with one extra hop. I'm not seeing any specific threat, I'm just wondering if all the proposed effort they are planning to do is actually going to improve security, because it doesn't seem like it to me.
    – techturtle
    Jan 25 at 21:04
  • 1
    There's no reason a client would listen on any network ports. Thus the second scenario is less likely.
    – vidarlo
    Jan 25 at 21:27
  • @vidarlo Can you elaborate? I'm a fairly savvy "consumer-grade" network user, but I'm not well versed in advanced security or networking so I'm not sure what you're saying there.
    – techturtle
    Jan 25 at 21:38
  • The threat you are seeing is from the home PC, then. But how would the home PC access the VPN set up by the work computer? It sounds like you don't understand how VPNs work. They are designed for use in untrusted networks. "they're now on the same network, after all" -- what network is that? The home network? That doesn't matter since the connection to work is over a VPN. The VPN network? If so, then where is the "extra hop" since the home computer has direct access?
    – schroeder
    Jan 25 at 21:47

2 Answers 2


A home computer connecting through VPN to the company is basically a privately managed device (BYOD) inside the sensitive company network. A company computer connecting through VPN to the company is a company managed device inside the sensitive company network.

I think it is a valid assumptions that a privately managed device can be way more risky to the company network and the data and business processes inside this network than a company managed device. Only the latter allows the company to control that the software running on the device follows company policies and to provide company managed endpoint protection against attacks to the device, data leakage etc. Of course, the actual security advantage depends on how good the device is actually managed.

And while restricting the access to RDP over VPN is a lower risk than an unrestricted VPN connection, a malware can still implement key and screen loggers and might also be able to forward control of the systems desktop with the established RDP session to an attacker. So it is important to properly protect the device even when using only RDP.

As for getting attacked from a compromised local network: a properly managed device will not allow any incoming connections from the network to the device. It will only use the network for establishing a connection to the company VPN. In the worst case this connection will fail, but this does not lead to a compromise of the managed device. Sure, there might be rare bugs which can compromise a device even in this case, like bugs in network drivers. But a well managed company device is typically more up-to-date and thus more hardened against these kind of attacks too.

In addition to this technical consideration there are also legal aspects, i.e compliance. Depending on the kind of data the employees have access to, there might be legal requirements for proper data protection like GDPR or such protection might be required for ISO 27001 and other certifications. Such protections are not only easier to implement and control on company managed devices, but it is also easier to argue from a legal perspective that sufficient controls are actually in place.

  • Thank you. I hadn't been thinking about this from a compliance or control position. I was mostly thinking if I know my computer is at least as secure (AV, firewall, etc) as the work PC, then it was effectively the same infection risk either way. My follow-up question then would be, from what you're saying, if I bring my work PC home, it should not be able to access resources on my home network, and my home devices shouldn't be able to access the work PC, right? If I can access in either direction, does that justify my original thought that the risk is the same?
    – techturtle
    Jan 26 at 14:50
  • 1
    @techturtle: Company managed devices might be specifically setup to allow selective access of resources at home which are needed for work - like a printer. Similar they might be setup to allow selective access to the device from outside, like being able to SSH into the machine. But on a company managed device this should be deliberate decisions as part of a broader security concept, because these surely increase the attack surface of the device and thus increase the risks. Jan 26 at 15:02
  • But it seems he is connecting to his work computer through rdp. Is it possible to make only his work computer accessible, nothing else? And there should only keyboard/mouse be sent in one direction and video in the other.
    – gnasher729
    Jan 26 at 22:57
  • @gnasher729: The setup is described in the question: RDP over VPN. This means there need to be a VPN connection first, which integrates the mobile device into the company network. Then there is RDP on top. Even if there are server side restriction to make sure that only the work computer can be accessed by RDP and nothing else, it is still possible for an attacker to take control of a running RDP session on a compromised mobile client. That's why it is important to properly protect the mobile client too. Jan 27 at 4:52

I bet they implemented Endpoint Detection and Response (EDR) (or other security tooling) on domain-joined devices but cannot install it on home systems. You can VPN-client via Remote Desktop Protocol (RDP) connect to a domain-joined system, those credentials could be compromised. Without proper network segmentation and other controls, the corporate network is at risk from a home user. Without various security controls like, EDR, web content filtering MFA, IP whitelisting, group policy restrictions, and tiered accounts, the attacker could move laterally into the network via RDP from an infected home system. EDR and other tooling on a corporate controlled device reduces the risk of this occurring.

Is this really any more secure, and if so, how is it better? Yes, a corporate device will have additional security controls. I would assume a corporate device has a hardened baseline, endpoint protection, forces updating/patches, and other protections in place.

  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jan 25 at 22:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .