DirectAccess & Split Tunnelling - Security Implications

[CHiLL]

We are currently testing DirectAccess for the purposes of staff accessing school data and SIMS, amongst other resources. Using Split Tunnelling - we can connect. There are some issues, such as SIMS not detecting the connect.ini file, but that can be looked at at a later time.

 

We have had a thought about Internet filtering. Whilst in school, our Internet is proxied through our ISP's web-filtering, which is great as it blocks a lot of malicious sites. On top of that, all of our devices are protected by an anti-virus. However we're just thinking that if someone gets infected whilst at home and using DirectAccess, it could easily spread across to our network via the mapped shares. Yes, that is a normal risk when they are on site, but we see more infections in general on laptops that go home than we do on the static in-school machines.

 

We've turned on Full Tunnelling, to force all traffic through our network (so hopefully the Internet will get routed through also) however I've lost connection to my test device at home. So until I get home, we can't test further (We get no mobile data signal, so we can't hotspot either).

 

After doing some research, a lot of people appear to have issues with Full Tunnelling. Usually with either it not working at all, or having dire performance issues and people seem to recommend using Split Tunnelling with another solution in-place the Internet connection, such as OpenDNS. I don't think OpenDNS is free for non-private use, so that won't be an option, along with any other solutions that require payment.

 

Any ideas on how I can provide more Internet-based security on our Split Tunnelling DA clients whilst off-site?

[Blue_Cookeh]

What do you use for filtering?

 

Coming from huge private (and now public) sector companies, it seems to be a risk most people are willing to take. The idea is that security takes a layered approach. You force Windows Firewall to treat all networks as Public apart from your own, and make antivirus updates available to your machines both on and off the network. Don't allow admin rights unless absolutely necessary.

 

That would cover most bases in terms of security, but you might also look at things like Microsoft EMET if you're that worried. We also put other guards in place, you can set up alerting of suspicious activity on your fileshares etc, and have appropriate firewall rules in place across your network. Remember DirectAccess devices aren't directly connected to your network, your DA server brokers the connection.

[CHiLL]

What do you use for filtering?

 

Coming from huge private (and now public) sector companies, it seems to be a risk most people are willing to take. The idea is that security takes a layered approach. You force Windows Firewall to treat all networks as Public apart from your own, and make antivirus updates available to your machines both on and off the network. Don't allow admin rights unless absolutely necessary.

 

That would cover most bases in terms of security, but you might also look at things like Microsoft EMET if you're that worried. We also put other guards in place, you can set up alerting of suspicious activity on your fileshares etc, and have appropriate firewall rules in place across your network. Remember DirectAccess devices aren't directly connected to your network, your DA server brokers the connection.

We are using RM's SafetyNet as our filtering.

Users are not admins on the machines.

I'll take a look at making Windows Firewall treat all networks as public except our own.

We're using SCEP from SCCM as our AV, with SCCM managing the updates. With DA, I'm hoping that clients will be able to connect to SCCM from home to receive updates.

 

Microsoft EMET appears to going EOL next year, plus our clients are currently running either Windows 8.1 or Windows 10 1607 (with Windows 10 1607 slowly replacing the Windows 8.1 clients), so hopefully they contain at least some of the protection mechanisms that EMET covers.