security concerns over VPN 1

[gensan]

I'm about to start a VPN implementation to remote sites. Can anybody please give me an idea on what are the security issues I should be looking into.


Thanks

 

[chiph]

The VPN technology itself is very good.

You should mostly be concerned with weak passwords, and passwords falling into the wrong hands.

Chip H.

 

[pansophic]

If I worried about anything, it would be the clients that will be connecting to my VPN. You absolutely do NOT want your employees using their own home computers to connect to your VPN, because you cannot control the security of their systems.

If an attacker can gain control of the client computer, then you may as well turn off your VPN because it provides absolutely no security. Once they get control of that system, then they can get both the private key and the passphrase.

We have a policy that no personal computers are used to access our network ever, even from home. That way we can control what applications are in use on every computer connected to our network. Plus, then you have fewer intellectual property issues, as you own the computer on which the work was performed.

pansophic

 

[jnicks]

Panasophic,

Stringent policy that.

Have you a policy on WiFi? It seems to me that 802.11b could poke a big hole in perimeter defenses.

 

[pansophic]

Yeah,

we have been working the wireless access out. Right now, we turn off SSID broadcast and do MAC level authorization and then VPN those clients in (they need the VPN anyway to get in from outside). We put the WiFi network outside our firewall and then tunnel the clients in.

We've been looking at some other devices like InterJak to see if they provide the level of protection that we need to move the APs inside the security perimeter.

http://www.filanet.com/index.php?side=home&home=products_products

pansophic

 

[jnicks]

Pansophic,

Nicely! I want to work at your joint (big grin).

J

 

[gensan]

Appreciate your comments and suggestions. But can anybody tell me what software/hardware are required? Pls stay on the basics. Or, can anybody point me to a link where I can download reference materials.

Thanks to all