This is Susan Bradley for CSO Online today we're going to talk about
split-level VPN and some of the risk regarding it Windows patching is coming
up and it's impactful during the best of times and during this time of a remote
working even more so many of you have home computers or corporate laptops that
are off the normal network connections and remoting in and you're probably
concerned like me of virtual private networks and remote desktop connections
being saturated with those Windows updates in those office 365 click to run
updates now remember you can set up what's called split level VPN so that
those management items that can go over a normal Windows Update connection do
not go through your VPN connection Microsoft released a blog post about how
to do this and in addition as part of their office 365 network onboarding tool
they've now include included additional testing for the split level you go to
the site put in your tenant name click to run the test and it will actually
tell you that you probably need some dotnet in order to install it in order
to run the advanced test that will test your split level you'll have to do an
installation of dotnet core you'll want dotnet core 3.1 and you'll go ahead and
install it once you have the dotnet core installed it will go ahead and and run
the tests and come back with results in my personal test here I'm not using a
VPN but as you can see they now included a VPN split tunnel configuration and let
you know if you've got it set up correctly often when I here split tunnel
talked about I see a near religious argument over the use of split tunnel
VPNs some will argue they provide the ability to place the network traffic
that is used for maintenance such as Windows updating installation to click
to run office 365 over the users local connection without introducing more rent
others say that unless you have all of the traffic that's intended for the
corporation to go through that network VPN you can't inspect the traffic and
thus you can't keep the firm secured the concern over the security about bpn
comes down to how you've connected the client or the workstation to the network
if you connect a remote client to your network using Virtual Private networking
and do not take the time to limit or restrict the client workstation an
infected machine can introduce risks and malware to your network but there's ways
to limit this risk often you can look to your firewall vendor that provides the
VPN software to see if they also attempt determine health risks to the
organization look to your endpoint management solution to see if they also
provide tools as well others argue that any time you connect any workstation at
all to your corporate network you need to ensure that the machine is patched to
a certain level has up-to-date antivirus definitions and follows a series of
guidelines for health that your corporate mandate requires currently
we're kind of in a transition phase between network access protection which
was used for Windows 7 and the use of Intune or other tools for Windows 10 in
turn can be used to check for BitLocker code integrity early launch anti-malware
which is only applying to PCs secure boot boot and other health conditions go
into Intune and create a policy the platform is Windows 10 and later and
then go through the different device health settings that you can set you can
require BitLocker require secure boot require code
integrity what that means is code integrity has to be enabled on the bite
device so that any drivers or any applications have to be code signed
device properties you can configure a minimum operating system and what valid
operating system builds are allowed to be used in the network you can require
device clients config from configuration
manager and then you can choose different security systems settings such
as encryption firewall trusted platform module antivirus anti-spyware if
defender anti-malware is your preferred setting require that you can set a
minimum version of anti-malware you can make sure that security intelligence is
up-to-date you can require real time protection if
you subscribe to microsoft defender ATP you can require that the device be added
or under the machine risk score so you can set that the client has a clear
security configuration meaning that it doesn't have any risks to the
organization there are third-party tools that do similar act kinds of activities
look to security modules such as carbon black endpoint response
oh-ho-oh SEC or even malwarebytes with suspicious suspicious activity modules
all of these can be adjusted to work with split tunnel setups in order to
properly secure the network now if you're in a situation where due to
shortages of corporate laptops you've had to resort to using home computers to
provide Hardware from remote working you may want to instead setup a remote
desktop system where the users remote into a virtual desktop setting and don't
use corporate assets bottom line should you be concerned about split-level
tunnel VPN absolutely but you should be just as concerned about any resource
connecting to your network ensure you have the ability to review the traffic
and be able to react to any threatening traffic coming into your network
especially now more than ever as always check out the resources on IDG Tech Talk
for the latest on the Cova 19 and what technology is doing to help you today
until next time stay safe stay well this is Susan Bradley for see us online