Is using a work computer on a home network really more secure than a home computer remoting to the work network?

Question

My company began allowing remote access work during lockdown, and still allows a limited amount of it. Originally, those of us with a sufficient computer at home were allowed to install the company-provided VPN on our home computers, then connect using RDP from the home computer to our work computer still physically plugged in to the company network. Now they are talking about requiring anyone who works from home to bring their work PC to their house and use it for doing the remote work.

I understand that an infected home PC connecting to the VPN could potentially transmit malware to the company network, but the proposed “solution” doesn’t seem any safer to me. Since I must plug my work laptop into my home network in order to get online and VPN back to the office network, wouldn’t that make the work laptop--and thereby the work network--vulnerable in much the same way?

Is this really any more secure, and if so, how is it better?

Answer 1

A home computer connecting through VPN to the company is basically a privately managed device (BYOD) inside the sensitive company network. A company computer connecting through VPN to the company is a company managed device inside the sensitive company network.

I think it is a valid assumptions that a privately managed device can be way more risky to the company network and the data and business processes inside this network than a company managed device. Only the latter allows the company to control that the software running on the device follows company policies and to provide company managed endpoint protection against attacks to the device, data leakage etc. Of course, the actual security advantage depends on how good the device is actually managed.

And while restricting the access to RDP over VPN is a lower risk than an unrestricted VPN connection, a malware can still implement key and screen loggers and might also be able to forward control of the systems desktop with the established RDP session to an attacker. So it is important to properly protect the device even when using only RDP.

As for getting attacked from a compromised local network: a properly managed device will not allow any incoming connections from the network to the device. It will only use the network for establishing a connection to the company VPN. In the worst case this connection will fail, but this does not lead to a compromise of the managed device. Sure, there might be rare bugs which can compromise a device even in this case, like bugs in network drivers. But a well managed company device is typically more up-to-date and thus more hardened against these kind of attacks too.

In addition to this technical consideration there are also legal aspects, i.e compliance. Depending on the kind of data the employees have access to, there might be legal requirements for proper data protection like GDPR or such protection might be required for ISO 27001 and other certifications. Such protections are not only easier to implement and control on company managed devices, but it is also easier to argue from a legal perspective that sufficient controls are actually in place.

Answer 2

I bet they implemented Endpoint Detection and Response (EDR) (or other security tooling) on domain-joined devices but cannot install it on home systems. You can VPN-client via Remote Desktop Protocol (RDP) connect to a domain-joined system, those credentials could be compromised. Without proper network segmentation and other controls, the corporate network is at risk from a home user. Without various security controls like, EDR, web content filtering MFA, IP whitelisting, group policy restrictions, and tiered accounts, the attacker could move laterally into the network via RDP from an infected home system. EDR and other tooling on a corporate controlled device reduces the risk of this occurring.

Is this really any more secure, and if so, how is it better? Yes, a corporate device will have additional security controls. I would assume a corporate device has a hardened baseline, endpoint protection, forces updating/patches, and other protections in place.