Can an attacker move from a branch office to the head office over the VPN?
Yes, if the site-to-site VPN lets every device at the branch reach every server at head office, which is common. A permanent VPN between offices joins them into one network, so an infected PC at the branch can scan and log in to head-office servers as if it were on the same floor. Limit what crosses the VPN: allow only the services the branch needs, such as the file server or the ERP, and only from the devices that need them. Use separate administrator accounts for each site. Watch the traffic that crosses the link. NetSenX flags scanning and lateral movement on every plan; with a sensor at each site you see an infection spreading from one to the other.
Read next
Related questions
- Should card terminals be on a separate network from office PCs?
- How can we check that office computers cannot reach our tills?
- What happens if an office PC infected with malware can reach the shop tills?
- Is a consumer router a security risk for a small office?
- What should we do with old devices nobody uses any more?