The year of the broken VPN
Aug 14th, 2024 by Jesper Kråkhede
If you look back at the first half of this year, one type of system stands out: VPN gateways and firewalls with remote access. Almost every major vendor has had a critical vulnerability exploited in the wild. In January, US federal agencies were even ordered to disconnect one vendor´s VPN appliances completely while the situation was investigated.
Why do they keep getting hit? Because they sit at the edge of the network, reachable from the whole internet. They are complex, often run old code and are hard to monitor from the inside. Once an attacker controls the VPN, he is inside the network with the same access as your users. And in the case of last year´s big Swedish ransomware incidents, VPN accounts without MFA were a common way in.
Patching faster helps, but it doesn´t solve the underlying problem. The VPN gives too much access to too many.
That is why I keep coming back to point to point access, or Zero Trust Network Access. The user connects to one application at a time, after verification of identity and device, and never to the network as such. There is no big gateway with an open port that gives access to everything. Microsoft Entra Private Access, now generally available, is one way of doing it.
Start with the users who only need a handful of applications. Move them first. Keep the VPN for the few that really need it, and protect it with MFA and close monitoring.
Every month you keep the old VPN is another month on the attackers´ shopping list.