3 ms·

Saying that VPN is an incomplete control is not the same thing as saying VPNs are pointless. And the real argument (VPNs used as an excuse to not secure hosts)

by lvh 8y ago

Saying that VPN is an incomplete control is not the same thing as saying VPNs are pointless. And the real argument (VPNs used as an excuse to not secure hosts) is even weaker. It’s often true! But that doesn’t mean a VPN isn’t an entirely reasonable control.

nickpsecurity 8y ago
The one thing I like about a well-designed VPN is it's work done once on a relatively-simple component that can pay dividends protecting many, many, network-facing apps. Those will usually be highly-complex, not made by security experts, coded partly/wholy in unsafe languages, and could even change a lot increasing misconfigurations. A good VPN often reduces a hard problem of defending all that software from network attack to a simpler problem of installing the good VPN with a configuration forcing everything through it. This is, of course, not excuse to ignore other vectors. It just does a lot for user with minimal effort. Excellent ROI. That's why tunneling proxies were used in high-security environments to protect messaging, voice, and video before apps were developed that had built-in protection. Just reuse the trusted, link encryptors or VPN's watching out for covert channels like traffic patterns. Fixed-rate, fixed-size with non-leaky, error messages covered that. Basically no effort to leverage them vs developing per-app solutions needing arbitrary protocols.
e12e 8y ago
There's also a reason ipsec is in the ipv6 spec; and a reason Google (reportedly) turned on encryption/vpn of their dark fiber links after the Snowden relevations: there is no such thing as a "secure" cable, or "physically private" network. You either encrypt your traffic, or you're vulnerable. That doesn't mean a vpn is sufficient for security, just means it's a prerequisite. People are pushing towards securing transport at the protocol layer - but it leaves issues like unencrypted dns, icmp etc.

by lvh 8y ago

nickpsecurity 8y ago

The one thing I like about a well-designed VPN is it's work done once on a relatively-simple component that can pay dividends protecting many, many, network-facing apps. Those will usually be highly-complex, not made by security experts, coded partly/wholy in unsafe languages, and could even change a lot increasing misconfigurations. A good VPN often reduces a hard problem of defending all that software from network attack to a simpler problem of installing the good VPN with a configuration forcing everything through it. This is, of course, not excuse to ignore other vectors. It just does a lot for user with minimal effort. Excellent ROI. That's why tunneling proxies were used in high-security environments to protect messaging, voice, and video before apps were developed that had built-in protection. Just reuse the trusted, link encryptors or VPN's watching out for covert channels like traffic patterns. Fixed-rate, fixed-size with non-leaky, error messages covered that. Basically no effort to leverage them vs developing per-app solutions needing arbitrary protocols.

e12e 8y ago

There's also a reason ipsec is in the ipv6 spec; and a reason Google (reportedly) turned on encryption/vpn of their dark fiber links after the Snowden relevations: there is no such thing as a "secure" cable, or "physically private" network. You either encrypt your traffic, or you're vulnerable. That doesn't mean a vpn is sufficient for security, just means it's a prerequisite. People are pushing towards securing transport at the protocol layer - but it leaves issues like unencrypted dns, icmp etc.