Your VPN is now your office
Mar 19th, 2020 by Jesper Kråkhede
This week the Swedish Public Health Agency recommended everyone in the Stockholm area who can to work from home. Many other countries have gone much further and closed down completely. Overnight the VPN went from a tool for travelling sales people to being the main entrance to the company.
That makes the VPN gateway one of the most important systems you have, and one of the most attacked. Since last year there have been several serious vulnerabilities in the big VPN products and they are actively exploited. So, technically, here is what to do this week.
Patch the gateway. If you can´t remember when you last did it, do it today. Then check the logs for strange logons from before the patch, because if someone got in you also need to change the passwords. Require a second factor for every VPN logon. Only allow managed devices to connect, if the product supports it. Split the traffic so Office 365 and other cloud services go directly to internet instead of through the VPN. It saves capacity and the cloud services are built to be reached from internet anyway. And send the VPN logs to your SOC.
Then think about the next step. Every application you can publish through the identity platform instead is one less reason to open the VPN.
Your front door just got a lot busier. Lock it.