Sales staff work from notebooks at customer sites and connect to the company through a VPN client. When is this a secure perimeter, and when is it not?
It depends on what the notebook may do besides the VPN. If extra measures restrict the notebook to communicating only inside the company perimeter, protection is complete. If the VPN only opens an encrypted channel while all other internet traffic goes out directly, the perimeter is broken.
The case: textile maker H equips its sales staff with notebooks so they can present the product catalogue at the customer's site, agree on custom work such as embroidery or special yarns, and close orders, in close contact with production. The IT department gave them a VPN client and put a VPN gateway in the company network.
| Option 1: full tunnel, locked down | Option 2: VPN plus direct internet | |
|---|---|---|
| Notebook's network access | Only into the company perimeter, no other networking | VPN into the data centre, plus direct unrestricted internet |
| Result | Complete perimeter protection | Perimeter protection is broken |
In option 2 the notebook is a bridge: malware it picks up from the open internet travels through the VPN straight into the otherwise unprotected data centre. Option 2 is what is usually called split tunnelling.