Make sure when allocating VPN connections that the remote computers meet the same security requirements as computers on your local LAN—stricter, if possible. At a minimum, all remote VPN clients should have antivirus software and firewall software to offer some minimal protection, although some personal firewall software can interfere with some VPN client software. Include VPN client systems, such as home computers, field laptops, and partner and vendor machines, in all security assessments or vulnerability scans that you perform. You can check them the same way you check your local machines by making sure your remote VPN clients are logged on when you do your security testing and including the VPN IP range in your tests. Just make sure you get permission before you scan any machines your company doesn't own. If you use Active Directory (AD), you can also push out a standard security policy to your Win2K or later VPN clients to make sure that they conform to the policy for machines on your network.
When you access the internet via Wi-Fi, do you think about who might be spying on your data, or even stealing it? If not, you're in the majority—unfortunately. Everyone ought to be using a virtual private network, or VPN, whether it's at a coffeeshop or even at home. Yet when PCMag ran a survey on VPN usage, we found a surprising 71 percent of our 1,000 respondents had never used a VPN at all. Even among net neutrality supporters—who you might think would be better informed on security and privacy issues—55 percent had never used a VPN.