The job I have requires that we have computers at home, a few years ago they had everyone install a VPN on our home personal computers (the company did not provide us with these computer) how safe if this, does the company now have access to our personal information? Is this legal?
-
2By saying "hey had everyone install a VPN on our home personal computers". Do you mean they told you to install a VPN client?– AdiFeb 18, 2013 at 13:04
-
If you are afraid of having something on your home computer that needs to be protected, buy a old laptop for work. If the company wants you to work 24 X 7, they should pay for a company laptop.– user20926Feb 19, 2013 at 12:16
-
2"is this legal" transforms the question into something that is very localized. "legal" changes from state to state and country to country. The FAQ discourages localized questions.– MCWFeb 19, 2013 at 12:34
Add a comment
|
3 Answers
I won't answer the legal question as it varies from location to location, but I will say that many companies in the US and EU are moving to a bring your own device (BYOD) model, where employees supply their own equipment. They wouldn't be doing that if it wasn't legal. Employees using their own equipment to access company resources is nothing new.
The answers to your other questions are partially determined by the VPN software. If the software is standard, off the shelf vendor software like Checkpoint Securemote or Cisco's VPN client then the software itself is pretty safe, they are well written, tested for vulnerabilities, and they don't have functionality in them that spy on your computer.
The final consideration depends on how safe your computer is. A VPN is two-way, so if you can connect to company systems they can in turn connect to yours. If your computer is well locked down, using NIST standards for example, and your OS and applications are up to date with a good AV product installed then you should be pretty safe. If you are sharing drives without requiring strong credentials, have poor passwords, or guest accounts for example it would be easy for people to access data on your computer if you employer's VPN device rules allow it.
-
Your first paragraph would be true if you were posting this a year ago. Actually companies are avoiding BYOD due to the security risks. Just check most popular LinkedIn's groups in information security.– user15194Feb 18, 2013 at 13:16
-
I'm not saying BYOD is a good idea for many companies. It often costs more to do it securely. But it is happening.– GdDFeb 18, 2013 at 13:19
-
@GdD agreed, BYOD is a huge industry and there's currently a race in adressing it. People want their iPhones instead of old outdated blackberries for example and software is being written to emulate enterprise functionality.– NULLZFeb 18, 2013 at 14:10
When the VPN is on, you can consider that your computer is part of the company network. This means you can access the services provided by your firm network (remote computer, printers, ...).
If your machine provides services over the network, then these services are also available for anyone located on the enterprise network. They also can be member on their own VPN.
Avoiding this can be achieve in many ways:
- Do not provide services over the VPN network (it usually has its own IP address range and service can be configured to behave differently depending on the network)
- Firewall the services when not on your home network, to avoid connections from the entreprise
- VPN connections may be established in such way that VPN client can only access the enterprise network and not been reached from it. Eventually there may remain attack vectors left to reach your machine, since you do communicate with the servers and this implies a bi-directional link is established.
Besides this, you are not free from exploits in the VPN piece of software or even a human malicious who provides you a VPN software with a virus charge, designed to allow spying on you. At some point, there has to be trust.
On the legal part, this is so dependent on the location that I can't go into this.
Regarding the "is it safe" thing, I personally would avoid providing VPN access for computer I do not fully manage. The firm has more to lose than you.
VPN connections are like any other network connection. They allow packets to flow in both directions. Whether or not it's possible for a "new" connection to be established (for example, a TCP SYN to be sent) in a particular direction is the responsibility of packet filtering rules.
Does your VPN client includes its own packet filters? Does it create a pseudo network interface that can be subjected to packet filtering built into your OS or other firewall software? These are the questions you need to consider in order to answer your question. Some closed-source VPN clients totally circumvent system-wide packet filters, and you are at the mercy of its operational parameters, which in some cases are managed from the VPN server.
