2

I connected to my home-made VPN, which uses OpenVPN and 2048bits encryption keys, from my work.

What are the security risks of doing so, given the fact that the servers are in the same network my work's PC is, and how can I minimize them if any?

Thanks

EDIT:

What I mean, is that the IT Manager seems to be pissed off by the fact that I connected a to my home via VPN to take some configs of my personal home server to apply to a server I manage in my work. I am sure he will say that "There are security risks" by connecting to my home. I sincerely don't see many risks, apart from having a super hacker in my home network which would be stupid because who would be interested in it? So, suppose this super hacker can connect to my Work PC from my home network while I am connected to my VPN. This is very difficult because I don't use the same password in my home and in my work, so he would not be able to SSH to my work pc, etc.

This is the only security risk I can think of... so I would like to hear from you if there are some others.

Improve this question
4
  • Can you clarify re @schroeder's comment?
    – Neil Smithline
    May 12, 2015 at 3:24
  • 6
    The problem with [home] VPNs from work is that you are creating a tunnel between the two. This allows remote access to the work network from outside the network, bypassing most firewall rules as the connection was initiated from inside the work network. You say your home network is secure because no "super hacker" would target you. That is funny because my grandmas computer has malware installed on it and I haven't the slightest clue what kind of super hacker would target an old lady.
    – David Houde
    May 12, 2015 at 3:36
  • @NeilSmithline, no, he's upset because of the connection. The servers are managed by me and monitored by them, I copied some Apache configs from a working environment.
    – JorgeeFG
    May 12, 2015 at 13:09
  • @DavidHoude what if my VPN network is on a network that can't reach PCs but servers? All of them have Ubuntu Server installed, malware is less probable
    – JorgeeFG
    May 12, 2015 at 13:11

2 Answers 2

Reset to default
12

I can understand why your IT Manager is upset.

How would you feel if some one, without your consent, bridged an unknown network with your home network?

You arguably bypassed any controls they had in place and bridged a completely foreign network with that of (what I can only assume is) a multi million dollar corporation.

What are the security risks of doing so, given the fact that the servers are in the same network my work's PC is, and how can I minimize them if any?

The risks are the same as any other PC/Server exposed to the internet - endless.

I sincerely don't see many risks,

And that is precisely why your behavior could be construed as reckless. Just because you don't see any risks doesn't mean there are none.

apart from having a super hacker in my home network which would be stupid because who would be interested in it?

There are many reasons for a hacker to be interested in your home network. For example:

The Value of a Hacked PC

Image from: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/

Improve this answer
3
  • Hi, thanks for the answer. It isnt a multi million company, it is an educational institution fairly new. (some years). I have made a list of 12 vulnerabilities that includes: Illegal Antivirus (and the antivirus knows it and pops up alerts). Cracked software. Windows PCs cracked. In the Windows PCs the users are administrators. There is no proxy, the website blocking is being done in hosts file. No MAC Address whitelist, anyone can connect a device to the network. So I think this "VPN connection" thing is just stupid.
    – JorgeeFG
    May 12, 2015 at 13:30
  • 3
    @JorgeeFG this answer is the correct one - you are NOT qualified to accept the risks of your actions - only the IT manager can accept those risks, and therefore is the only one who can approve activities. You might not see risks as probable, but then that's not your job.
    – schroeder ♦
    May 12, 2015 at 17:23
  • Best image for visualizing the importance of home network security.
    – user56893
    May 12, 2015 at 21:52
-4

It really depends on the work environment. And this has to be indicated so up front. If you are in a low grade security environment with BYOD policies in place, then it should be fine. Take the lead from the upper layers. If they're non plussed about security, then fine, they should be cognizant and comfortable with the disruption.

On the other hand, depending on how you feel about end point and lateral compromise, you might not want to take the chance of something from your home network spreading into the work environment.

You can only do so much about security until it becomes a major inconvenience, and that might translate into a billion dollar band aid.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .