S 4.321 Secure operation of a VPN

Initiation responsibility: IT Security Officer, Head of IT

Implementation responsibility: Administrator

Due to the data transmitted using VPNs, they are attractive targets for attackers and therefore need to be operated securely. Prerequisites for secure operation include the secure installation (S 4.319 Secure installation of VPN devices) and configuration of the hardware and software components involved (S 4.320 Secure configuration of a VPN). In addition, all organisational procedures must have been defined and implemented (e.g. reporting paths and responsibilities). The recommendations provided in safeguard S 2.418 Drawing up a security policy for the use of VPNs must be taken into consideration to this end.

More and more frequently, it is necessary that the VPN connections of organisations are continuously ready for operation in a stable manner. Many organisations require them to be available around the clock (24/7 operation). To ensure smooth VPN operations, it is therefore necessary to create an operating concept and develop a corresponding contingency concept as well (see S 6.109 Business continuity plan for the failure of a VPN). The following aspects must be taken into account in particular when drawing up an operating concept.

Monitoring

In this case, monitoring is understood in the sense of quality management. This means the quality of service provided by a VPN must be monitored continuously. The data obtained should be consolidated in management reports and submitted regularly (monthly or quarterly, for example) to the IT management. The parameters measured are used to continuously fine-tune the quality of service and distribution of the bandwidth in the VPN. This way, it is possible to detect bottlenecks as well as software or hardware problems early. Here, it is also necessary to consider whether the VPN availability must be secured using corresponding SLAs (service level agreements) or OLAs (operational level agreements). In addition to the regular reports, it is also necessary to immediately report any irregularities that suddenly appear so that the problems can be eliminated promptly.

Monitoring concept

In contrast to monitoring the quality of service as mentioned above, the monitoring concept attaches importance to the security of the VPN. The logged data recorded must be checked, evaluated, and archived (if necessary for legal reasons) according to the security policy (e.g. in terms of access restrictions).

The information gained within the framework of monitoring should be checked regularly by a knowledgeable administrator. The best possible results are obtained through the use of additional software specifically designed for the evaluation of logged data. It is important to ensure that the regulations of the data protection laws are complied with (see also S 2.110 Data protection guidelines for logging procedures).

Alarming

An alarm concept must ensure that the persons in charge are informed immediately when a critical situation is discovered. In such a situation, the safeguards specified in advance must be taken and the incident must be documented accordingly (see module S 1.8 Handling security incidents). To eliminate failures, the business continuity concept created with the help of S 6.109 Business continuity plan for the failure of a VPN can subsequently be applied.

Maintenance

Maintenance work should not be performed on a VPN while it is in operation, meaning as long as users are able to access it. Employees always need to proceed with caution when performing maintenance work. In order to perform maintenance work or make changes to the systems, it is necessary to specify the corresponding responsibilities in advance.

Maintenance windows must be defined for maintenance tasks and changes, and the corresponding workflows must be planned. The type, scope, time, and duration of the maintenance work must be announced promptly together with the services that will be affected by the work. After completing the maintenance or making a change, the modifications made must be documented and checked.

Authorisation for remote access VPNs

A common feature of remote access VPNs is that it is not only necessary for just a few VPN users to dial in to the VPN, but a large number. In general, these are users whose passwords may change regularly.

In order to make proper user authentication (e.g. via RADIUS, TACACS, TACACS+) possible for remote access, it is necessary to ensure the consistency of the authentication data. This can be achieved through central administration of the data (authentication server) or by synchronising the data periodically.

Connecting to remote access VPNs using dial-in lines

Depending on which type of VPN is used, users may also be able to dial in using data networks or dial-up connections such as ISDN or GSM. The following special precautions must be taken for dial-up connections:

Training and awareness-raising measures

The users of a VPN must be trained in the use of the security mechanisms of the VPN. For this, they should first be provided with an overview of the typical threats to VPNs and of the corresponding safeguards. However, the administrators and members of the incident handling team must also be adequately familiarised with the use of the security solutions offered by the VPNs. General information on this topic can be found in S 2.198 Making staff aware of information security issues.

Clients for remote access VPNs

It is frequently desired to allow individual users to dial in to the LAN of a company or government agency using an insecure network. Examples of this include telecommuters or users who dial in using a public wireless LAN or from a mobile telephone. Standard IT systems on which an application for dialling in to a remote access VPN has been installed are typically used for this purpose.

Since VPN clients for remote access are often operated in incompletely controlled environments, in this case it is necessary to use special mechanisms, procedures, and safeguards to guarantee the client is protected. Mobile VPN clients in particular are exposed to special risks, because they are easy to attack physically (e.g. theft or manipulation). If a VPN client is compromised, there is a risk that the security of the LAN could be adversely affected by the compromised client.

For this reason, the following aspects must also be taken into consideration for the secure operation of mobile VPN clients in addition to the recommendations in safeguard S 5.122 Secure connection of laptops to local networks:

Communication connections

For the secure operation of a VPN, it is necessary to encrypt all data transmitted. Furthermore, it must be possible to determine the authenticity and integrity of the transmitted data beyond any doubt. This can be guaranteed using the methods described in safeguard S 5.148 Secure connection of an external network with OpenVPN or in safeguard S 5.149 Secure connection of an external network with IPSec, for example.

Trusted VPNs

VPNs are seldom operated using network infrastructures under the organisation's own control. In many cases, VPNs are used to establish a secure connection using external networks like the Internet or a dedicated line from a third party provider. In the latter case in particular, it is necessary to monitor the connection in general, to monitor the quality of the connection, and to monitor the maintenance of the security aspects specified during the selection process (see S 2.420 Selecting a trusted VPN service provider).

Review questions:

© Federal Office for Information Security. All rights reserved.