Virtual Private Networks: Secure Twice, Open Once

The increasing popularity of virtual private network (VPN) technology has recently exposed a number of serious vulnerabilities in the software used to connect thousands of remote offices and workers to their corporate networks.

While the recent security alerts may have corporate IT managers taking a hard look at their VPN hardware and software, one prominent corporate security expert says that it is policies, not patches, that are needed to shore up VPN.

“It’s an education problem,” says Russ Cooper, surgeon general of TruSecure. “You have VPNs establishing bridges that result in a totally untrustworthy network being connected to an otherwise well-managed corporate network.”

What is needed, according to Cooper, are improved corporate IT policies that crack down on sloppy practices, like allowing employees to alter the configuration of company-supplied hardware in order to facilitate file sharing and Web browsing at home.

Or, Cooper suggests, IT managers can stop treating VPN clients as if they are part of the internal company network and start treating them like what they areuntrusted external hosts attempting to access an intranet.

“You can still allow employees to VPN through the corporate gateway, but make them pass through the firewall, antivirus and content filtering first,” says Cooper.

And, while Cooper doesn’t see any of the recently publicized VPN software vulnerabilities being used in large, distributed attacks, that doesn’t remove the risk of the vulnerabilities being exploited in potentially devastating one-on-one attacks from disgruntled employees or motivated groups of individuals.

Regardless of whether their own network has been attacked, however, Cooper sees benefits for corporate IT managers in keeping on top of their VPN technology. “Given the value that corporate IT managers place on the integrity of their VPN connections, they should deem them as extremely important and patch them right away when patches become available,” he says. -P.R.