3

Let's say the situation is this: I'm a big corporation with a whole bunch of GDPR compliance and other regulatory stuff which means I need to ensure that certain data doesn't leak (so basically most companies dealing with data).

Like most other companies I need to give certain staff access to prod data to complete certain tasks. I also put software on work computers to monitor communications so that if I suspect a data leak is likely I can monitor the appropriate traffic and catch them before anything sensitive/legally protected gets out. I also enforce that only employees connected to the VPN can access the data on our prod systems and lock out USB ports so manual transfer cannot easily happen.

However, there is a still an internal attack vector. At present any person authorised to access the data can install the VPN software on a non-protected machine and completely bypass the monitoring software, meaning it would be possible for them to download and potentially leak data without anyone knowing. I could install certs on a machine that ensure only machines with a certificate can connect to the VPN, but surely these certificates can be copied onto any machine? I considered MAC address as a method of identifying the machine but I don't believe that will work due to it being layer two. Is there any method of a) ensuring a cert issued for a certain machine can't be copied between machines or b) otherwise identifying the source machine and ensuring an authorised person can't use non-authorised hardware to access protected data? If so, are these methods limited to particular VPN systems e.g. Wireguard/OpenVPN/IPSec or operating systems?

Obviously there are also other methods of data transfer like taking photographs of the screen, manual transcription etc but the consideration here is that a) I'm mitigating or eliminating every potential vulnerability possible to demonstrate utmost due diligence and b) I'm more bothered about large-scale data leaks than smaller ones c) for the absolute most sensitive data, on-prem requirements can mitigate or eliminate these risks as well.

3

1 Answer 1

5

Different VPN clients have different methods for accomplishing this.

  • some issue device-bounded clients that are generated from a base server, so users only get one, and the client is machine-bound, including device certificates
  • some check to see if a company-provided agent is already installed
  • some VPN clients run an inspection of the device to look for specific markers/etc. to determine if it can run at all or connect to approved destinations

These types of protections are not common on free/open-source VPN clients. You're looking at commercial products.

ZTNA option

You are also looking at a common problem that Zero Trust is meant to solve. ZTNA solutions, which are steadily replacing VPN for corporate access, do what you are asking for.

Jump Box option

Your other option is to block direct access to sensitive data from the VPN. Connecting to a "jump box" in your environment where you can maintain control and have your DLP monitoring, means that it doesn't matter what external device connects.

2
  • 1
    Yes. Overall they are excellent against mistakes, where someone wants to simplify things by connecting their personal laptop to corporate VPN - but not so much against determined inside attacks.
    – vidarlo
    Mar 23, 2023 at 11:34
  • 2
    To address the direct question about copying certificates, some solutions have the client/machine certificates be TPM-bound to prevent copying.
    – user71659
    Mar 23, 2023 at 20:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .