Eric M Russell (1/7/2013)
GSquared (1/7/2013)
Eric M Russell (1/7/2013)
Using the a VPN to connect to my desktop at the office, I don't even have any corporate email on my laptop, it absolutely nothing work related except for the VPN client configuration itself.However, when using VPN it's important not to save your login credentials in Remote Desktop. Giving a hacker the opportunity to Remote Desktop into your office is an even worse scenario than having a laptop with confidential data on it.
We use 2-factor authentication on VPN. Even with stored credentials, it dials your phone and you have to hit the hash (#) key on the phone to authenticate there. That way, if someone steals your laptop (or finds it and decides to joy-ride, I guess), unless they also get your phone, they can't connect to VPN.
Storing RDP credentials doesn't matter (much) unless you have your VPN domain password on the laptop, even without 2-factor authentication.
If someone got my laptop and my phone, they'd still need to know my current domain password, before they could connect VPN. If they have all that, then stored RDP credentials are the least of my worries (especially since they already have the domain username and password somehow, in order to establish the VPN connection).
I don't dial in through a phone connection, always some broadband connection from multiple locations, but I guess the VPN could be setup to only accept from specific IP address. You're right, I first have to login to the VPN using my domain uid/pw. However, knowing hackers, they can probably find a way to decrypt any credentials stored in the VPN or Remote Console config, so I type everything in manually.
I'm not dialing in via a phone connection. Connect however you normally do, but the VPN server then calls a pre-defined phone number that's assigned to you. Can be your business cell phone, for example. The phone rings, you pick up, hit # on the phone keypad, and then it considers you authenticated. That's AFTER you've typed in your username and password to the VPN client. Nothing to do with how the computer (laptop or otherwise) is connected, just an authentication step.
With that, even if someone uses a keylogger to steal your UID and password, and can somehow copy the VPN connection settings via packet-sniffing or something, unless they also steal your phone, they can't connect.
- Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
Property of The Thread
"Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon