VPN, client cert per device. SSH key per device. Full-disc encryption. 2fa. Single sign-on. That's about it.
Oh, and a clear internal/external machine split with an internal firewall to partition your network.
Ask HN: How Do You Maintain Security When Working Remotely?
21–30 of 55 posts
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#22Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…
> Oh and another thing a lot of people don't know: The OS stores Wifi passwords in EFI boot variables. This is used for Internet Recovery. So if your device is stolen or just lent to someone else, consider your Wifi passwords compromised, regardless if the disk was encrypted.
I can't speak for if this is true or not, but I literally yesterday ran Internet Recovery and it didn't remember my wifi password. I had to re-enter it myself.
Little Snitch is a good reverse-firewall which might be preferable to messing around with /etc/hosts for many, especially since it offers active protection.
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#23Some others have provided their inputs, my one is just short: take your devices with you, all the time. Yes, that includes the quick toilet break at starbucks.
I can't remember how many times I heard total strangers asking around "can you look after my stuff quickly?". You can do that for your beach towel, but not for your devices.
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#24Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…
Leaking what data?
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#25I run a 2-3 person shop working on SAAS and iOS apps. We don't use VPN, because most of the communication goes through HTTPS anyway (github, gmail). I just made sure that everyone has 2FA and strong passwords on key services. Oh, and don't download user data to your machine.
How do you "make sure" they've got strong passwords without compromising password security for those people? Do you just have their word, hear them press many keys when authenticating, ...?
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#26Can't speak for other OSes but OS X constantly phones home to Cupertino, sometimes not even using encryption, thus leaking data when you're booked into a public Wifi. I literally spent weeks last year grepping the entire Mavericks base installation for hardcoded URLs, domain names and IP addresses and setting up entries in /etc/hosts and NAT rules to hardwire that stuff to 127.0.0.1. I also had to disable lots of Lau…
> Oh and another thing a lot of people don't know: The OS stores Wifi passwords in EFI boot variables. This is used for Internet Recovery. So if your device is stolen or just lent to someone else, consider your Wifi passwords compromised, regardless if the disk was encrypted. I can't speak for if this is true or not, but I literally yesterday ran Internet Recovery and it didn't remember my wifi password. I had to re-…
Retrieving wifi passwords from NVRAM:
/usr/libexec/airportd readNVRAM
nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:current-network
nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-networks
nvram 36C28AB5-6566-4C50-9EBD-CBB920F83843:preferred-countRe: Ask HN: How Do You Maintain Security When Working Remotely?
#27Full disk encryption, close the lid of the laptop when you wander away from it. No need for a VPN if your connection to the email, chat and vcs servers are using TLS. If not, why not? It is the year 2015.
Why not?
Because you're leaking DNS traffic.
Why not?
Because you're disclosing where your company assets are reachable from a public connection.
I don't know, but a publicly reachable vcs server that's supposed to contain confidential data makes me shiver.
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#28I run a 2-3 person shop working on SAAS and iOS apps. We don't use VPN, because most of the communication goes through HTTPS anyway (github, gmail). I just made sure that everyone has 2FA and strong passwords on key services. Oh, and don't download user data to your machine.
How do you "make sure" they've got strong passwords without compromising password security for those people? Do you just have their word, hear them press many keys when authenticating, ...?
In our case, we run the widely available password cracking tools and rainbow tables against our stored passwords. If we can get them, those users are notified and their passwords reset.
Yes, we leave any salts and hashes in place - it limits the checks we can reasonably make to the usual password lists but it still catches a large number of poor passwords.
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#29I don't particularly have any security measures other than a secure password, full disk encryption and locking the screen after a few minutes. If you are taking a device outside of the office (e.g. to take home to work over the weekend) you should be using those anyway. Pretty much all the services (even internal systems for staff only) I interact with are available publicly and have HTTPS, so using a VPN isn't reall…
> using a VPN isn't really going to change much
I disagree, using a VPN on open wifi protects against HTTP downgrade attacks, weak cypher compromise, replay attacks... HTTPS for most sites is just not as secure as it should be. It also masks your traffic so outsiders can't even see what servers you are accessing, or how.
Wrapping the traffic in a VPN and securing access to your internal assets to office and VPN IPs offers another layer of security against even targeted attacks.
Re: Ask HN: How Do You Maintain Security When Working Remotely?
#30Full disk encryption, close the lid of the laptop when you wander away from it. No need for a VPN if your connection to the email, chat and vcs servers are using TLS. If not, why not? It is the year 2015.
Why not? Because you're leaking DNS traffic. Why not? Because you're disclosing where your company assets are reachable from a public connection. I don't know, but a publicly reachable vcs server that's supposed to contain confidential data makes me shiver.
Not to mention vulnerabilities to the myriad of various SSL attacks out there.
Unless you have a crack team of sysadmins who responds to every CVE against OpenSSL and maintains every webserver perfectly, you run the risk of compromising corporate data if you rely solely on SSL to protect your corporate assets.