5 ms·
> Commercial enterprise VPN products are an open sewer, Commercial enterprise VPN products exist for one reason: To allow the enterprise security office to ti
by pwg 7y ago
> Commercial enterprise VPN products are an open sewer,
Commercial enterprise VPN products exist for one reason:
To allow the enterprise security office to tick off the checkbox on the quarterly compliance forms that essentially says: "using a VPN to provide secure communications".
Security is only a secondary consideration, if it is even considered at all.
- mc32 7y agoHonestly, isn’t 90% of compliance like that? Checking boxes...
- emn13 7y agoThe thing is, people are very good at checking boxes, and not very good at remembering important things. So while it may seem inane, plain old checking boxes is almost certainly part of a good strategy for dealing with tedious, repetitive tasks where one error can cause serious issues - and this kind of security is probably one of those. Obviously, it's not enough, nor an excuse to turn off your brain - but it's a pretty proven behavioral pattern.
- mc32 7y agoSure I mean it’s a lot of CYA regulation-wise. Because if you chose a solution which is arguably better but not part of the list and the one on the list which is a worse solution isn’t checked, well you’d better have your resume ready when something happens.
- ohashi 7y agoFlying is a great example of 'checking boxes' saving lives.
- deleted 7y ago[deleted]
- paulddraper 7y agoHaving worked a lot with security compliance, I'll say there are two types of things you do: 1. The things for compliance. 2. The things for security. Only rarely does something fit in both categories.
- chelmzy 7y agoFrom my experience corporate VPNs exist to allow employees to access internal resources remotely. They aren't typically used for security although they can provide some form of security for remote workers.
- lwf 7y agoOf course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet. VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine, not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often they lure IT environments into a false sense of security.
- kirbypineapple 7y agoYou're ignoring the reality that most enterprise software is a tire fire (from a security standpoint) and that it's not feasible to secure hundreds (or even dozens!) of enterprise apps. VPN's are the enabler that ensures status quo remains.
- stjohnswarts 7y agoCan you propose an alternative solution?
- lwf 7y agoI agree — band-aids aren't per-se a bad thing. However, a VPN isn't the ideal end state. Even if you can't modify the underlying application, the goal should be "wrap in a reverse-proxy that handles authn / some-amount-of-authz so you can minimise the risk". VPNs handle network security, but don't protect you against an attacker able to compromise an endpoint in your corporate environment.
- morpheuskafka 7y agoSome protocols/services are designed with a local network in mind and would require modifications to work on the internet. A VPN is invisible to the apps and can easily save a lot of work in a large IT environment with numerous internal services.