4 ms·
The thing is that VPNs are usually deployed in the way i described. No ACLs, everyone on the VPN is "trusted" regardless of position and role, with services beh
by sofixa 4y ago
The thing is that VPNs are usually deployed in the way i described. No ACLs, everyone on the VPN is "trusted" regardless of position and role, with services behind often relying on the fact that the VPN is securing them.
- xiwenc 4y ago“Trusted” does not mean authorized. I have never seen any (corporate) environment that uses VPN and not require some form of authentication & authorization on top. With “trusted” status often grants those trusted users read only access to internal communication or documentation.
- awinder 4y agoUtilizing VPN as _a_ layer of network security with additional systems access security is something we learned in the old pre-2020s era, and I’ve never seen a cavalier system like you’ve described deployed. But maybe it’s just because I’m not up to date on “state-of-the-art” 2020s systems.
- fulafel 4y agoIn practice VPNs are a very visible layer that people will tend to rely on when they decide what security measures to implement. They are very clunky, so people end up assuming that they must provide quite a lot of security, to be worth enduring.
- elric 4y agoDo you have any sources for this claim? Are there any stats about VPN deployments anywhere? I have never seen a VPN deployed in this way. Who are the companies that do this? Mom and pop shops with a two employees? Or 1990s corporations which were blissfully unaware of online threats?
- kelnos 4y agoNot sure where you're getting this idea. I've never been on a VPN where services inside the VPN all just assumed I was allowed to be there. Internal services still at least required a username and password, and some would require 2FA as well. I'm sure there are some VPNs that are implemented a poorly as you describe, but I'm not sure that's the common case like you seem to think.