So while i came after this time, when I hear hacker I think Richard Stallman, Linus Torvald, Bajarne Stroustrop, ie i think of it in the old sense. How is it that now when people hear the hacker they think someone who plants viruses and malware? is there like a major event that happened?
can people still target individuals at their workstations as they work from outside the local network but on the net without having to have installed any virus or do any social engineering first?
Like people behind a NAT/PAT of some type? They can, but not directly. If there's a public facing server they can get on to first, they can go from there to private stuff. Or they can get access to a VPN which would usually give you direct access to workstations. Just depends on how they have the network setup.
Another way is to get the workstation to initiate contact with you first. Maybe make a connection to a website you own. That way you can talk directly to the workstation. But you can't make unsolicited communication directly to a device that is being NATed
because one person could be a liability for the whole network
People are always a liability to the network. People want convenience and convenience is the enemy of security.
Our VPN is quite strict and we have never had a problem with it (even when we have had stolen laptops). We have had more problems with internet facing ports and staff plugging things into the network that should be and teaching them not to blindly click on links.
VPNs are pretty damn secure. We've never had an issue. Though there was a recent phishing attack for VPN logon info that hit several institutions lately. Luckily our staff is smart enough to send in any suspicious looking emails to us.
I think the only security issue we ever has is just due to myPHPAdmin not getting updated when it needs to...