Услуга · Information security

VPN and cryptography

Everything that leaves the office must be protected in transit: links between branches, work from home, exchange with contractors. That is not a recommendation but a direct requirement, and it is met by technical means.

Sites
a permanent link
Remote work
with no open ports
Sign-in
with a second factor
Revocation
on the day of departure

What the work includes

The schemes differ: a permanent link between offices and access for individual people are built differently and should not be confused.

Discuss the scope

Between offices

A permanent secure link between sites with a backup channel in case of a break.

Employees

Connecting from home and from trips always with login confirmation by a second method.

Contractors

Separate accounts with trimmed rights and an expiry date after which access lapses by itself.

Certified products

Solutions supporting the required algorithms where the regulations demand it.

A second factor

For all external connections without exception, including for directors.

Log

Who connected and when, with automatic disconnection of idle sessions.

How it goes

A project for two or three sites takes one to two weeks including testing the failover to the backup link.

01

Diagram

We establish who needs to reach what. Full access to the whole network is needed by practically nobody.

02

Configuration

We deploy the gateways and write the routes and group-based access rules.

03

A second factor

We connect it, hand it out to people and help set it up on their devices.

04

Testing

We test the failover to the backup link and write short instructions for users.

A remote access account survives a resignation more often than any other. Internal access is revoked, while the connection from outside is remembered six months later during an incident review. Revoking external access should be the first item in the leaving procedure, not the last.

Questions and answers

It depends on what they need. If full work with files and systems is required, a secure tunnel with group-based restrictions. If there are only one or two tasks, publishing a specific application is often enough, without letting the person onto the network at all.

With separate accounts limited by time and by resource: access only to the server they work on and only for the term of the contract. A shared contractor account is a guaranteed incident sooner or later.

Technically you can; in practice we strongly advise against it. A guessed or stolen password for an external connection gives an attacker exactly what a pass to your office would. A second factor closes that scenario almost completely.

We will build secure links

Write how many sites and remote staff you have. We will propose a scheme with redundancy and cost the equipment.