Tier 3 access from home

vollmersj commented 4 years ago

The problem

Covid-19 requires much more work tacking place form home. Is there a possibility to increase other security enhancements to support Tier 2 and Tier 3 environments accessed from home. This is particularly important for considering a virtual DSSG or potential DSG.

Current Turing solution for Tier 3 access from home

IT are testing the following.

There is a new Tier 3 VPN
The Tier 3 VPN provides connected client devices the IP of the Turing's on-site secure "Tier 3 access" network that is already authorised to connect to Tier 3 environments
Connections to the Tier 3 VPN will be restricted to specific Turing managed devices that have been approved for Tier 3 access. These devices will be Turing managed laptops or Chromebooks.
Users must authenticate with their Safe Haven username and a separate local password when logging into the Chromebook. This gives them a user account that lets them save browsing history, files etc.
Users must authenticate with their Safe Haven credentials when connecting to the Tier 3 VPN. This authentication will require MFA.
Once connected to the Tier 3 VPN, the managed device will be connected to the secure "Tier 3 access" network and can connect to Tier 3 SRE remote desktop gateway portals, where they will need to log in again using their Safe Haven credentials.
While connected to the Tier 3 VPN users will also be able to access the general internet .

jemrobinson commented 4 years ago

@martintoreilly , @getcarter21 and I discussed this last week. Can we collect discussion on this issue?

getcarter21 commented 4 years ago

I suggest a call on this Tomorrow or Weds. Ian

From: James Robinson notifications@github.com Sent: 23 March 2020 17:52 To: alan-turing-institute/data-safe-haven data-safe-haven@noreply.github.com Cc: Ian Carter icarter@turing.ac.uk; Mention mention@noreply.github.com Subject: Re: [alan-turing-institute/data-safe-haven] Covid19: Security review or enhancement for distributed (#542)

@martintoreillyhttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fmartintoreilly&data=02%7C01%7Cicarter%40turing.ac.uk%7C543fa977373c4a6756b308d7cf52f408%7C4395f4a7e4554f958a9f1fbaef6384f9%7C0%7C0%7C637205827498627740&sdata=JCvMkdOwEnf1q2iWd2yPA3H0idcrlbQzKCgzpGjAJYc%3D&reserved=0 , @getcarter21https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fgetcarter21&data=02%7C01%7Cicarter%40turing.ac.uk%7C543fa977373c4a6756b308d7cf52f408%7C4395f4a7e4554f958a9f1fbaef6384f9%7C0%7C0%7C637205827498627740&sdata=QdnOiemiLKHuEmA14IEX6H0DTtQgpeNNomldi8RkAVU%3D&reserved=0 and I discussed this last week. Can we collect discussion on this issue?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHubhttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Falan-turing-institute%2Fdata-safe-haven%2Fissues%2F542%23issuecomment-602758532&data=02%7C01%7Cicarter%40turing.ac.uk%7C543fa977373c4a6756b308d7cf52f408%7C4395f4a7e4554f958a9f1fbaef6384f9%7C0%7C0%7C637205827498637704&sdata=%2BUj6QZeF6AsX5YmYVdKZN50ojOfo%2FmaIg%2FjRQTj31Fc%3D&reserved=0, or unsubscribehttps://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAIHULIIRLSAE67NTWI2HSLLRI6OVXANCNFSM4LO4D2AQ&data=02%7C01%7Cicarter%40turing.ac.uk%7C543fa977373c4a6756b308d7cf52f408%7C4395f4a7e4554f958a9f1fbaef6384f9%7C0%7C0%7C637205827498637704&sdata=KwX5xT4nzmYfqXIf5mmcg8EAKKaNJ9TXDvrNvxRAkOY%3D&reserved=0.

jemrobinson commented 4 years ago

If we fix this, it will also close #54, so I'm closing that as a duplicate of this.

jemrobinson commented 4 years ago

Notes from call with @getcarter21 and @martintoreilly

require users to register their IP address with Turing IT to be added to a whitelist
only whitelisted IP addresses will be allowed to connect to a dedicated VPN
- might be possible to use SSO to ensure that <SHM domain> credentials are used to connect to the VPN
would need to ensure that the secure (Tier-3) IP address also has permissions to access Tier-2 environments
we need to be able to revoke VPN access (does this need per-user certificates?)
- should be controlled by the existing username/password authentication to the VPN
use Egress email to send certificates to users and for them to register their IP addresses

JulesMarz commented 4 years ago

Does the above rule out tier 3 as they would need managed devices?

jemrobinson commented 4 years ago

I think we'd have to relax the managed device requirement (in consultation with the data provider).

martintoreilly commented 4 years ago

Current Turing solution for Tier 3 access from home

IT are testing the following.

There is a new Tier 3 VPN
The Tier 3 VPN provides connected client devices the IP of the Turing's on-site secure "Tier 3 access" network that is already authorised to connect to Tier 3 environments
Connections to the Tier 3 VPN will be restricted to specific Turing managed devices that have been approved for Tier 3 access. These devices will be Turing managed Chromebooks.
Users must authenticate with their Safe Haven credentials when logging into the Chromebook. This gives them a user account that lets them save browsing history, files etc.
Users must authenticate with their Safe Haven credentials when connecting to the Tier 3 VPN. This authentication will require MFA.
Once connected to the Tier 3 VPN, the managed device will be connected to the secure "Tier 3 access" network and can connect to Tier 3 SRE remote desktop gateway portals, where they will need to log in again using their Safe Haven credentials.
While connected to the Tier 3 VPN users will also be able to access the general internet .

martintoreilly commented 4 years ago

Closing as we have a solution operational for the Turing tier 3 Safe Havens

alan-turing-institute / data-safe-haven