1

We have a normal on-premise Class C network with an internal IP address scheme of 192.168.15.x (hypothetical). We have a SonicWALL device that acts as a VPN server for external clients, a DHCP server for both internal and external clients, and a firewall.

We also have a Windows 7 Pro computer on our network that is owned by a contractor. This computer is maintained by the contractor, and they connect to it using a commercial remote viewing program (TeamViewer) when we call them up and say we are experiencing problems with their service.

The contractor's computer controls our building HVAC systems and has a program that runs on it that connects back to the HVAC central servers.

This workstation is not on our Windows domain and thus is in a workgroup by itself, but it does have a static IP address that is in the 192.168.15.x Class C range. It also has our network gateway's IP assigned and uses our DNS server, as well.

This workstation has no antivirus and is lacking several years of Windows Updates. In addition, Windows Updates will not install correctly.

How much of a threat is this workstation to attacks such the recent Windows worm vulnerability from RDP? How much of a threat would this workstation be to our other network computers if it was compromised? My lack of knowledge stems from what exactly an attacker could do with this computer, since it is not on our Windows network BUT it is on our network IP range. Could the attacker, for example, attempt to reach our servers, even if they aren't part of the Windows domain? Is the fact that this workstation is on our IP range threat enough to take steps to update it and get an antivirus program on it? Would this workstation be able to turn on network discovery, for example, and get a list of attackable computers on our network?

Improve this question
1
  • 2
    Network classes are dead (please let them rest in peace), killed in 1993 (26 years ago, before the Internet went commercial in 1995!) by RFCs 1517, 1518, and 1519, which defined CIDR (Classless Inter-Domain Routing). Modern networking does not use network classes.
    – Ron Maupin ♦
    May 21, 2019 at 0:08

1 Answer 1

Reset to default
7

The situation you describe is very similar to what cost Target* many millions of dollars when its network was hacked, and customer information was stolen. Never let another company have something with unfettered access to your network. You have not vetted the employees, subcontractors, or security of the other company. When that company gets hacked, the hackers then have access to your network, too.

Properly, you should have a restricted VLAN that has no access to the rest of your network, only to the public internet through your firewall, on which you place something like this and other things, like IoT devices, that are security risks.

*Target Data Breach

Improve this answer
3
  • 1
    I'd add that ideally, you should also have a separate internet connection just for guests, IoT devices, vendors, etc.
    – Jesse P.
    May 21, 2019 at 1:16
  • @JesseP., yes, but that seems unlikely in the described situation.
    – Ron Maupin ♦
    May 21, 2019 at 1:17
  • Agreed. Just saying it as a "best practice".
    – Jesse P.
    May 21, 2019 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.