3

To allow third party consultants, offshore developers and contractors working on the code, we can expose our Git repository externally. Or we can grant VPN access to the external parties and limit their access by configuring a new group on firewall so they can only access the Git repository in our internal network.

Which of these two options is a better security choice? Some arguments I have myself are:

1- By exposing our code repository over the Internet, we are opening door to hackers doing brute forcing on the Git. Also if there is any zero day in Git, we are impacted.

2- By providing VPN access to third parties, we allow untrusted entities into our internal network, and if the firewall rule setting is not configured well, our internal network which is more sensitive is exposed.

Improve this question
2
  • 1
    Is setting up a separate network just got external git access an option? One that has no access to the main internal net?
    – MrSynAckSter
    Feb 17, 2015 at 19:18
  • That would have been ideal, but no time to restructure our network. We have to rely on right rules on our VPN firewall.
    – Goli E
    Feb 17, 2015 at 19:23

2 Answers 2

Reset to default
5

Given that you cannot use a dedicated, isolated network for this, I would suggest a modified version of option 1:

Allow access over the web with rigorous security checks.

  • If possible authorize git users using a cryptographic key (the way github does.) This will make brute forcing attacks very difficult.

  • Use IP filtering. That is, find out the IP addresses of your contractors and only accept queries from those IP addresses.

  • Make sure you have good firewall, IDS rules on this box.

Improve this answer
3

This is a great question and one that companies often struggle with. I would say that giving the contractors VPN access generally provides more security than exposing it externally. Consider that your code repositories likely contain secrets and API keys and the like, despite policies to the contrary.

If you're like most environments, compromise of your GitHub Enterprise server could lead to complete compromise of your network, and depending on your business model, could also lead to your customers being exposed to compromise. Exposing this server to the internet at large would make it more likely a random attacker could compromise what are likely your crown jewels.

The only caveat to this would be the way you provision users for your VPN. If users are added to an LDAP server and that gives them lots of implicit access to your environment, a compromised contractor account could potentially do a lot of damage. If you can provide more details about how your VPN access is granted I could potentially swing toward exposing GitHub as opposed to the VPN, but generally VPN is best in these situations.

Improve this answer
3
  • That's an interesting point of view. Can you give examples how the compromise of Git Lab server can lead to complete compromise of the network?
    – Goli E
    Feb 17, 2015 at 22:19
  • Well, consider secrets you might manage in your environment such as SSH keys, API keys, etc. Imagine if those are hardcoded in your source code instead of stored in environment variables or other means to keep them more compartmentalized. Anyone with access to that repo could compromise any system reliant on that secret material for its confidentiality.
    – theterribletrivium
    Feb 18, 2015 at 0:41
  • I really think secrets and API keys in the source code are quite an issue - if company developers do stuff like that, this is a bigger security issue than vpn vs external access.
    – Davide Orazio Montersino
    Jul 4, 2017 at 9:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .