Check: SRG-NET-000369-VPN-001620
Virtual Private Network (VPN) SRG:
SRG-NET-000369-VPN-001620
(in versions v2 r5 through v1 r0.1)
Title
The VPN Gateway must disable split-tunneling for remote clients VPNs. (Cat II impact)
Discussion
Split tunneling would in effect allow unauthorized external connections, making the system more vulnerable to attack and to exfiltration of organizational information. A VPN hardware or software client with split tunneling enabled provides an unsecured backdoor to the enclave from the Internet. With split tunneling enabled, a remote client has access to the Internet while at the same time has established a secured path to the enclave via an IPsec tunnel. A remote client connected to the Internet that has been compromised by an attacker in the Internet, provides an attack base to the enclave’s private network via the IPsec tunnel. Hence, it is imperative that the VPN gateway enforces a no split-tunneling policy to all remote clients.
Check Content
Verify the VPN Gateway disables split-tunneling for remote clients VPNs. If the VPN Gateway does not disable split-tunneling for remote clients VPNs, this is a finding.
Fix Text
Configure the VPN Gateway to disable split-tunneling for remote clients VPNs.
Additional Identifiers
Rule ID: SV-207243r856717_rule
Vulnerability ID: V-207243
Group Title: SRG-NET-000369
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002397 |
The information system, in conjunction with a remote device, prevents the device from simultaneously establishing non-remote connections with the system and communicating via some other connection to resources in external networks. |
Controls
Number | Title |
---|---|
SC-7 (7) |
Prevent Split Tunneling For Remote Devices |