3 ms·

Why not just make the back office require 2fa? No need for a VPN

• mschuster91 6y ago
  Simple: because an Internet-accessible backend will always be a prime target for hackers. RCE exploits, API endpoints where the developer forgot or misconfigured the authorization checks, credential spoofing/phishing... keep that stuff on the real intranet and a whole class of attacks simply vanishes.
  • Skunkleton 6y ago
    For small organizations isolating this stuff on an intranet makes sense. For larger organizations that is less valuable, as the intranet becomes less trusted. Some larger companies have done away with large portions of their intranet.
  • madjam002 6y ago
    And a VPN isn't subject to exploits or misconfiguration either? I'd much rather put my back office behind a 2fa in the browser than use a VPN, it's a far better user experience. Using an off the shelf reverse proxy or commercial solution mitigates to some extent the risk of developers messing up the auth, but both a VPN and proxy can be misconfigured. https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
    • robotnikman 6y ago
      I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against all known vulnerabilities. Overall I think its best to keep those things on the company intranet and only accessible remotely via VPN, while further limiting the employee to have access only to the services they need on the network Even better though, why not use both 2fa and locking such improtant services to the intranet or behind a VPN