I am currently working with a client in the healthcare sector. Part of the work will involve contact with sensitive patient health information (PHI). The client uses AWS and keeps their sensitive data inside of a Virtual Private Cloud.
It is required that I connect to a VPN Server to get access to their AWS services. They use OpenVPN client.
But they have the VPN configured so that when I'm connected to it, all of my internet traffic gets tunneled through the VPN server, not just the traffic bound for their network resources. This slows my internet connection down to about 1.5 Mbps down, which is not ideal.
I brought it up with them and they said "the security rules prevent anyone from any IP address except the VPN endpoint from getting any information about our instances.". But unless I'm missing something, that doesn't really answer my question.
Are there any real security advantages for them to set up their VPN this way?