Scope

Scope learns least-privilege rules for a company VPN from its own traffic. In the platform it becomes an Advisor plugin for gateway mode, which is on the roadmap but not in 0.4.0.

Many company VPNs are still flat. Once a login is accepted, its owner can reach every internal system on every port, and so can anyone who stole that login. Scope reads the connections through the VPN gateway, learns who uses which systems, and drafts rules that give each person and each team just that. Before anything is enforced it replays recent traffic against the draft and shows what would have been blocked.

What It Showed

Scope ran as a separate engine in VPN Works 0.2.0, tested on one Linux machine against made-up offices in private test networks. In its recorded case, rules learned from two weeks of traffic stopped 136 of 144 attempts made with a stolen login. The case study

Where It Fits Now

On the platform, Scope’s learning is exactly what an Advisor plugin does: read recorded traffic, write advice for a person to review. What it needs first is gateway mode, where vpnw takes the connections of every device behind a machine instead of one program’s. Scope comes back as an Advisor for gateway mode, after Ledger, Exit and Lab. Roadmap

Scope’s code, its tests and its demo office are in the repository’s history at the v0.2.0 tag.