VPN porn accident. Nauga's fault.

Neal Howard said:
If you can RDP directly into your work machine without having to do it via a vpn connection then that means your work network has diddly squat for security and is likely already pwned by numerous hackers. Placing a windows machine directly onto the Internet is like shooting fireworks while fueling your car at a gas station. Even if it's behind a nat router with port forwarding for RDP, that's only pretend security. Windows software firewall is no real security either.
Click to expand...

Yeah, but is that his job or concern?:dunno: If he's worried about being caught surfing porn, my guess is not.
 
Henning said:
Yeah, but is that his job or concern?:dunno: If he's worried about being caught surfing porn, my guess is not.
Click to expand...

Geez......
Come on guys.. It is 6PC / Bryan..... Of COURSE he is surfing porn... That is a no brainer...:yes::yes:.......:D
 
It's not so much the surfing porn with 6PC, it's the type of porn.

"Is that...a...head of......cabbage and.............Florence Henderson?"
 
This might have already been said. But the question is whether or not you are using a split-tunnel VPN. A split-tunnel VPN will only send traffic destined to your work network through the VPN. A full-tunnel VPN will route everything. For work PC's I always set them up as full-tunnel. If I have a user off-site doing work on Starbucks wifi, I want their traffic encrypted and filtered by MY firewall.

You can determine your setup in the VPN properties.
 
Neal Howard said:
If you can RDP directly into your work machine without having to do it via a vpn connection then that means your work network has diddly squat for security and is likely already pwned by numerous hackers. Placing a windows machine directly onto the Internet is like shooting fireworks while fueling your car at a gas station. Even if it's behind a nat router with port forwarding for RDP, that's only pretend security. Windows software firewall is no real security either.
Click to expand...


This configuration is actually common and accepted as industry standard when using a Windows Remote Desktop Gateway Server provided that server is in the DMZ. It's a fine line to walk ensuring network security while also keeping it simple enough for users to actually use.

http://windows.microsoft.com/en-us/windows7/what-is-a-remote-desktop-gateway-server
 
Heftiger said:
This configuration is actually common and accepted as industry standard when using a Windows Remote Desktop Gateway Server provided that server is in the DMZ. It's a fine line to walk ensuring network security while also keeping it simple enough for users to actually use.

http://windows.microsoft.com/en-us/windows7/what-is-a-remote-desktop-gateway-server
Click to expand...
Not sure I would listen to Microsoft's advice on that. Personally, no way in hell I would expose RDP to the internet as a whole, unless my goal was to get the machine hacked.

Expose as little as possible, even exposing SSH on a Linux box is something I started to be uncomfortable with about ten years ago.
 
jesse said:
Not sure I would listen to Microsoft's advice on that. Personally, no way in hell I would expose RDP to the internet as a whole, unless my goal was to get the machine hacked.



Expose as little as possible, even exposing SSH on a Linux box is something I started to be uncomfortable with about ten years ago.
Click to expand...


You're not opening RDP to the Internet. You are using AD credentials (no different than VPN) to authenticate the user, and then serve up the RDP service. If you can't authenticate with the server, you never see the devices on the other side. It's a great solution for companies who need RDP and not VPN. Most companies use VPN for just RDP, and that's a waste.
 
Last edited:
Heftiger said:
You're not opening RDP to the Internet. You are using AD credentials (no different than VPN) to authenticate the user, and then serve up the RDP service. If you can't authenticate with the server, you never see the devices on the other side. It's a great solution for companies who need RDP and not VPN. Most companies use VPN for just RDP, and that's a waste.
Click to expand...

You're still exposing that AD crap to the internet. No thanks. I wouldn't even dare expose IIS to the internet. If I had to use IIS I would front it with linux boxes running nginx as a proxy.
 
jesse said:
You're still exposing that AD crap to the internet. No thanks. I wouldn't even dare expose IIS to the internet. If I had to use IIS I would front it with linux boxes running nginx as a proxy.
Click to expand...

What do you mean by "exposing" it to the Internet? In a proper configuration, it would be in a DMZ surrounded by IDS. So only the necessary ports are getting to the box, after having run through your FW. And when I was responsible for such things, the internal interfaces would come into a separate DMZ, so the "clean" traffic would have to pass through another FW and IDS. In that configuration, the DMZ box is really more of an application proxy and front-end. And of course it is stripped, locked down, and running HIDS.

I have't had my hands dirty with this stuff in a few years, so I am sure best practices have changed some.
 
Lindberg said:
What do you mean by "exposing" it to the Internet? In a proper configuration, it would be in a DMZ surrounded by IDS. So only the necessary ports are getting to the box, after having run through your FW. And when I was responsible for such things, the internal interfaces would come into a separate DMZ, so the "clean" traffic would have to pass through another FW and IDS. In that configuration, the DMZ box is really more of an application proxy and front-end. And of course it is stripped, locked down, and running HIDS.

I have't had my hands dirty with this stuff in a few years, so I am sure best practices have changed some.
Click to expand...

You can shove things through an IDS and firewall all you want but you still have a windows service that can be accessed via the internet. Not something I'm comfortable with...but what do I know..

 
Old Geek said:
The equivalent of NASA forms at work would actually be a pretty good thing.
Click to expand...
20 years ago I was giving a presentation concerning new software we'd installed. The gist of it was to track IT problems, and being new to the dept. and young and gullible I said pretty much what my boss told me to say.

"The object is to identify the problems we are encountering. We will not be looking to see whose fault it was and point fingers." A lot of guffawing and snickering. Still, I believed.

Fast-forward a month and I'd never believed I would see that it was being used as "evidence" of fault.

So I'm not really sold on self-reporting at work to avoid repercussions. Around here at least they'd be collected and stored in your HR file.
 
Gerhardt said:
20 years ago I was giving a presentation concerning new software we'd installed. The gist of it was to track IT problems, and being new to the dept. and young and gullible I said pretty much what my boss told me to say.

"The object is to identify the problems we are encountering. We will not be looking to see whose fault it was and point fingers." A lot of guffawing and snickering. Still, I believed.

Fast-forward a month and I'd never believed I would see that it was being used as "evidence" of fault.

So I'm not really sold on self-reporting at work to avoid repercussions. Around here at least they'd be collected and stored in your HR file.
Click to expand...

The equivalent to the workplace NASA form is to become indispensable.
 
jesse said:
You can shove things through an IDS and firewall all you want but you still have a windows service that can be accessed via the internet. Not something I'm comfortable with...but what do I know..
Click to expand...
I don't have any idea what you know.:dunno: Shall we start listing the vulnerabilities in UNIX services over the years?

I've been a CISSP for more than 15 years, hold multiple vendor and third-party security certifications, and designed network architectures for fortune 500 companies in a previous life. But none of that means anything, and like I said, it isn't what I do anymore.

On the Internet, no one knows you're a dog, or cares. ;)
 
Lindberg said:
I don't have any idea what you know.:dunno: Shall we start listing the vulnerabilities in UNIX services over the years?

I've been a CISSP for more than 15 years, hold multiple vendor and third-party security certifications, and designed network architectures for fortune 500 companies in a previous life. But none of that means anything, and like I said, it isn't what I do anymore.

On the Internet, no one knows you're a dog, or cares. ;)
Click to expand...
Plenty of vulnerabilities in Unix services over the years - although it's usually an unfair comparison. Most Unix/*Nix distributions ship with thousands of more software packages and services than Windows Server does. Microsoft manages an impressive number of vulnerabilities for the very limited capability their Server product actually contains.

Question about what you wrote:
Lindberg said:
You're not opening RDP to the Internet. You are using AD credentials (no different than VPN) to authenticate the user, and then serve up the RDP service.
Click to expand...
I'm no expert on the Microsoft stack. Please point me to some information that would indicate how you would permit someone to log into RDP using AD credentials over the internet without exposing RDP to the internet.
 
jesse said:
I'm no expert on the Microsoft stack. Please point me to some information that would indicate how you would permit someone to log into RDP using AD credentials over the internet without exposing RDP to the internet.
Click to expand...


Technically it's possible via a built in proxy server on the MSFT stuff, but it really doesn't add any significant security. What it does do is wrap the connection with an encrypted tunnel. Not that very many encryption protocols are really holding up all that well these days when targeted for real audits.

No offense to the local PoA CISSP, but I know at least two who have been CISSPs that long, who couldn't secure anything if they tried. Nether had ever worked as an admin and only knew theory. A significant problem in the Security biz these days. Take a test, you're a security engineer. CISSP is a large amount of data but it's still possible to get through it without much real experience. It has a work experience requirement in security related work, but there's all sorts of ways to cheap out on those.

I've seen desktop support people who did nothing more than load virus scanners for desktop security for a living, call that the experience necessary. Maybe it's changed since then, but I doubt it.

SANS certs and using students' work as their own knowledge library, sure paid for a nice house on Maui for Northcutt though, that's for sure. ;)
 
denverpilot said:
Technically it's possible via a built in proxy server on the MSFT stuff, but it really doesn't add any significant security. What it does do is wrap the connection with an encrypted tunnel. Not that very many encryption protocols are really holding up all that well these days when targeted for real audits.

No offense to the local PoA CISSP, but I know at least two who have been CISSPs that long, who couldn't secure anything if they tried. Nether had ever worked as an admin and only knew theory. A significant problem in the Security biz these days. Take a test, you're a security engineer. CISSP is a large amount of data but it's still possible to get through it without much real experience. It has a work experience requirement in security related work, but there's all sorts of ways to cheap out on those.

I've seen desktop support people who did nothing more than load virus scanners for desktop security for a living, call that the experience necessary. Maybe it's changed since then, but I doubt it.

SANS certs and using students' work as their own knowledge library, sure paid for a nice house on Maui for Northcutt though, that's for sure. ;)
Click to expand...
I've passed every CISSP practice test I've ever taken and I haven't studied it at all. Pretty confident I could walk in and pass it with no thought if I actually cared about getting it.
 
PPC1052 said:
Geek fight!
Click to expand...


LOL. Not really. Most IT certifications based on ideals and not specific equipment, are a joke. CISSP rises to "almost not a joke" level, amazingly. But it's still pretty laughable.

Here's what PCI says one needs, out of many things, to be certified...

"All unnecessary functionally on devices and computers within the cardholder data environment have been disabled."

I could make a pretty good case that the mouse and mouse drivers aren't truly "necessary". Get used to running Windows with the keyboard kiddies. Haha.
 
They also say I need a published company security policy. They don't say it has to be any good! LOL.

(Granted some peoples are audited, but we aren't that important.)

"Set your password to 'password1'." Sounds like the beginning of a beautiful security policy to me, how about you? LOL
 
denverpilot said:
They also say I need a published company security policy. They don't say it has to be any good! LOL.

(Granted some peoples are audited, but we aren't that important.)

"Set your password to 'password1'." Sounds like the beginning of a beautiful security policy to me, how about you? LOL
Click to expand...

Much of what PCI asks for is just policy, and that policy can be essentially anything because there is no guidance on the subject.

I suggest folks maintain basically a set of policies to meet PCI precisely and *NOTHING* more. If you want more policy, go at it, but do that in additional policies that have nothing to do with what you show the auditors.
 
You are fine. As long as your browser isn't going through their proxy at the time, you are good to go.

SixPapaCharlie said:
I am not using a VPN connection.
If I connect to VPN, my local internet is disabled.

I just RDP to my work machine w/o connecting to VPN
Click to expand...
 
You must log in or register to reply here.
Back
Top