More and more workers are working remotely these days.
The problem with utilizing VPN software to connect to work resources is that end users are creating an open tunnel between their home and corporate networks. This method allows full remote access to the entire work network from outside the office, bypassing most firewall rules (the VPN connection is technically initiated from inside the work LAN). In most cases, the entire corporate network is accessible to the remote worker, exposing all servers and desktops rather than just the resources needed.
In this scenario, any security vulnerability or malware present on the remote worker’s computer and network can infect the work network for the duration of the VPN connection. This includes viruses. For example, if the remote PC has a nasty virus, it can spread across the VPN to the corporate network and could bypass work firewall protections. In addition, if the remote PC is compromised, it could be used as a conduit directly into the office LAN where hackers can exploit vulnerabilities to gain unauthorized systems access.
For example threats such as the Cryptolocker viruses typically rely on Windows file shares (SMB) to encrypt files are exposed.
The following is a home VPN user scenario that keeps IT managers up at night:
A remote teleworker is connected to the VPN from their home PC and gets infected by Cryptolocker. At the time of infection, they happened to be mapped to a corporate network drive. Perhaps they pay the ransom or perhaps not (maybe they don’t because they have backups of the work on their own home machine). The timer lapses and the teleworker runs a malware cleaner to remove the infection. They’re relieved, but unaware that they’ve encrypted several files on our network drive due to the original infection. They don’t think to inform the IT department, because it’s an issue with their home PC and not "work-related.”
A few weeks pass and other workers discovers that a file on the network drive won’t open. They flag it to the IT department. The IT team restore the file from backup, but unfortunately it turns out that only encrypted files have been backed up for the past 4 weeks… So the company has now lost the data as a result.
This situation could become exponentially worse, as thousands of network files could be encrypted and the business would never know until somebody tries to open them and is unable to do so because of the infection.
What are folks doing to secure their VPN clients to reduce these concerns?