Caution urged on endpoint VPN security

Companies consider it important to check whether or not remote computers meet corporate security profiles before they gain VPN access, but endpoint checking cannot address all the problems the machines might cause.

Because endpoint security can prevent infected machines from spreading malicious code to corporate networks via VPN connections, it has become a standard offering of the most remote-access VPN vendors, including Aventail, Check Point, Cisco, Citrix, F5 Networks, Juniper and Nortel.

But the technology also has inherent shortcomings. It cannot guarantee that a particular computer will be free of infection when it joins the network. For instance, a key area for endpoint software is to check for antivirus software, and it relies on periodic updates of signature libraries to be effective.

It takes a certain amount of time for antivirus vendors to discover viruses, identify signatures for them and update their signature libraries. During that interval, the virus could infect a machine that is running the latest version of corporate-prescribed antivirus software. The endpoint check would find the computer in compliance with security requirements and admit it to the network, where it could introduce the virus.

"The problem with endpoint security is that in concept it's a great idea," says Zeus Kerravala, an analyst with the Yankee Group, "but in practice it has problems."