Home page logo
/

basics logo Security Basics mailing list archives

RE: PC Anywhere and security
From: "Sadler, Connie" <Connie_Sadler () Brown edu>
Date: Mon, 27 Feb 2006 15:36:51 -0500

 
How do you share VPN with vendors when certs/keys are involved?

Connie J. Sadler, CM, CISSP, CISM, GIAC GSLC Director, IT Security, 
Brown University Box 1885, Providence, RI 02912 
Connie_Sadler () Brown edu
Office: 401-863-7266
PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x91E38EFB
PGP Fingerprint: DA5F ED84 06D7 1635 4BC7 560D 9A07 80BA 91E3 8EFB

-----Original Message-----
From: Sap . [mailto:0xsapx0 () gmail com] 
Sent: Thursday, February 23, 2006 1:56 PM
To: martin samson
Cc: security-basics () securityfocus com
Subject: Re: PC Anywhere and security

I recommend requiring the use of a VPN by all vendors, then using the
remote access software over the VPN, you can use VPN policies or IPSec
policies to prevent the remote user from accessing anything but that
box.

PCAnywhere is not insecure, but a VPN is secure, PCA can suffer from
MITM attacks, possible compromise of the client workstation allowing an
attacker to use it to gain access to your network. (Think Remote Exploit
+ Reverse VNC + PCA)

- SaP -

On 2/21/06, martin samson <martcci () hotmail com> wrote:
Hi group,

We used to have PC Anywhere (long long time ago...in the 80's) as a 
remote support system. We've moved away from it and now a supplier 
wants to connect to his box with it.  What position should the server 
be to be secure (network, DMZ, special zone)?

Can you give me an idea on how secure are the last versions of PC
Anywhere?

Can a PC Anywhere connection give them access to our network even if 
the user credential limits the rights to specific directories on his
machine ???

Thanks!

Marty



----------------------------------------------------------------------
----- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The 
Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting
experience.
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity 
Planning, Computer Emergency Response Teams, and Digital
Investigations.

http://www.msia.norwich.edu/secfocus
----------------------------------------------------------------------
-----



------------------------------------------------------------------------
---
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich
University program offers unparalleled Infosec management education and
the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity
Planning, Computer Emergency Response Teams, and Digital Investigations.


http://www.msia.norwich.edu/secfocus
------------------------------------------------------------------------
---


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault