Ask the Expert

Can Trojans and other malware exploit split-tunnel VPNs?

How secure are split-tunnel VPNs? Is it possible for a Trojan, rootkit or other malware to infiltrate the corporate network via a split tunnel and expose sensitive data? And is it true that compliance regulations like PCI DSS frown on split-tunnel VPNs?

    Requires Free Membership to View

Split-tunnel VPNs are neither secure nor insecure in and of themselves. When making the decision to tunnel all traffic or implement split tunneling, however, you'll need to balance the desire to control all user traffic against the potential risks -- to both the user and the organization -- of handling external traffic.

The beauty of split tunneling is that your enterprise doesn't need to provide the general Internet access point for a VPN user. With split tunneling, the VPN client automatically determines whether a network location is accessible through the virtual private network and, if it is not, passes it directly through the network connection. If users send only 10% of their traffic to your corporate network, you're letting their current access provider handle the other 90% of the load.

On the other hand, split tunneling may leave users with a false sense of security. If they're following instructions to "connect to the VPN from the road," employees may believe that all of their traffic, including their personal email and Web browsing data, is encrypted by the VPN. They may not realize that the traffic is open to interception on the local network.

From a compliance perspective, PCI DSS doesn't make any statements about split tunneling. I believe you could construct a rational argument for either approach during a compliance audit. Split tunneling wouldn't really reduce the risk of malware infecting your corporate network. If it's present on a machine before it connects to the VPN, it will still be present on that machine when it connects, regardless of your VPN tunneling strategy. If you wish to ensure that systems connecting to your VPN are free of malware, I'd recommend investigating the use of network admission control (NAC) technology.

More information:

  • Mike Chapple explores the security risks of IPsec tunneling.
  • A reader asks, "Do split-tunneling features make a VPN vulnerable?"
  • This was first published in February 2008

    There are Comments. Add yours.

    TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

    REGISTER or login:

    Forgot Password?
    By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
    Sort by: OldestNewest

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to: