Preventing VPN-based break-ins
In places where you have administrative control over a VPN-connected PC, audit the configuration, settings and behavior, and remotely reset them when you detect abnormalities. Where you don't have control, monitor the traffic and behavior, and remotely disconnect the devices when you detect abnormalities.
To lock out hijacked PCs authenticated to your VPN, you will need to authenticate an authorized user's physical presence or certified authorization at an application transaction level.
Smart cards, authentication tokens, one-time passwords, an intrusion-detection system working with a virus-scanning gateway and a PC configuration monitoring and management suite can be used to build the access-control, authentication, authorization, auditing, accounting and administration capability you need to detect and drop offensive connections. At a minimum, you should time out inactive sessions, perform configuration checks at logon and install an intrusion-detection system.
As a network architect at Change at Work in Houston, Blass understands the strain of developing and managing networks. Send your problems to dr.internet@changeatwork.com
Ask Dr. Internet archive
Past columns.
