3

I work in the cybersecurity division of my employer in a regulated field.

Where I work, edge perimeter controls on firewall are set up to DENY All incoming connections originating in blacklisted countries (e.g: North Korea). If an employee has exceptional need to remotely connect to corporate network, such as when traveling, individual case by case review is required from cybersecurity management prior to whitelisting the connection. Additional conditional access rules via NAC are set up to ensure BYOD devices connecting remotely from potentially untrusted locations have a minimum security baseline.

Quite a while ago, we had a security incident in which an employee traveling was actually working in a blacklisted country, but from which access to our network was not blocked due to use of an unauthorized personal VPN (rather than company VPN) to hide source IP address.

  • Does NAC have ability to detect traffic that originates under an VPN IP rather than a true IP being masked by the VPN tunnel?

  • Other than whitelisting the authorized company VPN , can NAC or other technical controls be used to block personal VPN connections?

1 Answer 1

6

Does NAC have ability to detect traffic that originates under an VPN IP rather than a true IP being masked by the VPN tunnel?

It's possible to detect VPN traffic inside your network, but it's not easy (maybe not even possible) to detect if there's a VPN between the visible destination and some invisible endpoint somewhere else, behind a computer that your network don't control.

Even if NAC could easily detect a VPN, the user would let a computer running at his home, access that computer via VNC over VPN and access your network from his home computer, without a VPN in the way. For NAC and everyone else, his home computer is accessing the network. He could install a proxy on that computer and configure his applications to use the proxy. No VPN here too between the computer and your network.

You could run an agent on the computer to verify if there's a VNC or VPN or proxy software running on the computer, but the user could use a KVM (keyboard-mouse-video) device and still have remote access without the agent detecting anything.

The user could have VPN running on a second computer, access it remotely, and have the first computer act as the gateway for the first. It would work and your network would not detect that either.

Other than whitelisting the authorized company VPN , can NAC or other technical controls be used to block personal VPN connections?

This is not a technical issue, but a policy issue. It's not productive to play catch with technical people, they will always find a technical loophole. This is a policy issue. A policy clearly stating that working on some countries is not allowed and using VPN on them will be solved with termination is the proper way to deal with the issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .