Public WiFi security

[fiza]

If you have staff that use public WiFi in places such as hotels, cafes and airports how do you protect their connections? Do you install VPN software and if so what is recommended?

[Roberto]

I guess, where do you think the threats are, what would they be connecting to, and how would they be connecting?

If they're connecting to RDP sessions then in 2022 those should be through a RDP gateway regardless, which acts as an SSL VPN effectively.

If they're connecting to cloud sessions, then those should be via an SSL/TLS web connection, which will effectively encrypt the connection.

Of course, at this point you're potentially vulnerable to MITM attacks so that's where the VPN comes into play. However, some services won't work well over a VPN (e.g. try doing a Teams or Zoom call over a VPN and you'll have latency issues).

 

So yes, VPN all the things is still a thing, but should be done intelligently - you're protecting the data and the service so focus should be on those things. Are users locked down so they can't override unexpected certificate errors when connecting? That and certificate pinning will help secure connections to services like GApps or O365.

 

What's the fallback when your VPN is down? Do you have support for the stance that its more important to encrypt connections than get jobs done if the VPN fails for any reason? Are the devices themselves using, e.g. bitlocker to encrypt data at rest?

[fiza]

This is mainly for staff using mobile phones to access webmail and google docs. Some may be using personal laptops.

[Roberto]

This is mainly for staff using mobile phones to access webmail and google docs. Some may be using personal laptops.

 

I think you're probably already doing pretty good then. Access to webmail (Google also?) and Google Docs will be locked down anyway, especially if they're doing so via apps.

[FN-GM]

All our devices have a always on VPN. Whenever you content to a network it is automatically on in the background. The end user has no idea.m it’s even there.

[fiza]

All our devices have a always on VPN. Whenever you content to a network it is automatically on in the background. The end user has no idea.m it’s even there.

 

Is this back to the "office" network or any network?

[FN-GM]

Is this back to the "office" network or any network?

 

Everything goes back to the office.

[fiza]

Everything goes back to the office.

 

Our case is purely checking emails and possibly viewing or editing docs in Google Drive.

[FN-GM]

Our case is purely checking emails and possibly viewing or editing docs in Google Drive.

 

Regardless of the usage it always goes via the VPN. Once that device is connected there is risk of attack.