Can I run an argument that was put to me when I was looking at this?
Someone said, look, when people remote in, they fire up the VPN.
So they have a local VPN client on their workstation.
That VPN client then means that all IP traffic
travels through our corporate network, and therefore,
they're basically firewalls on our corporate network.
And I was saying, yeah, but when they're off the VPN,
they're on whatever network they're on.
Can you turn it on without the VPN on?
And the answer is yes.
So do they still need a personal firewall then?
So if they, when they're disconnected from that VPN are,
for lack of a better term, unprotected, right,
such that they may be exposed to malware or keystroke capture,
or attacks,
or things like that that then would be effective
when they are connected to the VPN, then I would say,
no, that's not sufficient.
If there's some sort of tool that then maybe checks for
that kind of malware or does some sort of posture
evaluation and then flags any concerns,
that could potentially be a compensating control.
You evaluate it on its merits, right,
on the rigor of that examination to say okay,
when it does connect, we make sure that the machine is --- The posture is good.
Yeah, is clean, right?
And then if that's sufficient, that's got merit.
So you could use Mac basically.
Conceivably.
So network access control.
Checks the posture, make sure the firewall is set,
make sure the firewall is not disabled,
make sure that traffic can only go down the VPN,
and you've got the same functional requirement of that box can't be
attacked when it's plugged into any old network.
Right.
Yeah, I mean I know my work laptop, when I plug it in, it does nothing.
The first thing it does is it fires up the VPN,
and it connects me to the corporate network because it's never on my local
network apart from a few seconds to pick up the Wi-Fi basically.
Right.
I've not tried attacking it obviously because my life is too short to do that,
but that type of thing,
and now I know it's reporting back that it's configured properly.
Sure.
And that brings up the point that maybe that's an interesting
sort of candidate for a scenario in the penetration test is not
just testing the sort of endpoint with all the servers and the
card data and whatnot,
but can you attack one of these administrator or workstations,
right?
Particularly if there's some sort of situation like that,
is that effective against an attacker?
Yeah.
So, and this is something where DSS gets really interesting.
Because if you look at the intent of the standard, it's to keep you secure.
Right.
But I would imagine the, you know, if you said to an organization,
oh, in segmentation scoping I want you to pen test my admin workstations,
you and I would agree that was a great security thing to do,
but does someone want to pay for that as part of their assessment?
Well, I mean nobody wants to pay for any part of this,
right, and so at the risk of maybe jumping ahead,
when we talk about segmentation testing,
I think it's important to work with the pen tester and the organization to
devise what the appropriate segmentation testing scenarios are.
So let's put personal firewalls and segmentation testing on
our requirement 11 things to talk about.
Agreed.
Great.