VPN & Remote Access Security

Remote User                   Internet (Encrypted)              Corporate Network
┌──────────────┐    ┌──────────────────────────────────┐    ┌──────────────────┐
│ Laptop        │────│  ======== VPN Tunnel ==========  │────│ Internal Resources│
│ VPN Client    │    │  (AES-256 encrypted packets)     │    │ File Server       │
│ (WireGuard/   │    │                                  │    │ Intranet          │
│  OpenVPN)     │    │                                  │    │ Email             │
└──────────────┘    └──────────────────────────────────┘    └──────────────────┘

Allow split tunnel for:
  - General employees (web browsing, streaming)
  - Contractors (limited internal access)
  - SaaS-based companies (most apps are internet-based)
  - Video conferencing (low latency required)

Require full tunnel for:
  - PCI/SOX regulated roles
  - Access to sensitive databases
  - Legal and HR departments
  - All privileged accounts (admin access)

April 29, 2021:
  └─ DarkSide ransomware group gains access to Colonial Pipeline network
  └─ Entry vector: Compromised VPN credential for an old VPN account
  └─ Account was no longer in active use but still enabled
  └─ VPN did NOT require MFA (single-factor authentication only)

May 4, 2021 (6 days later):
  └─ Attackers deploy ransomware on Colonial Pipeline billing systems
  └─ Operations systems (pipeline control) are isolated — NOT affected
  └─ But billing systems taken offline → cannot invoice customers
  └─ Decision: shut down pipeline operations as a precaution

May 7, 2021:
  └─ Colonial Pipeline publicly discloses ransomware attack
  └─ Fuel panic buying begins across US East Coast

May 8, 2021:
  └─ Jet fuel shortage at major airports (Atlanta, Charlotte)
  └─ States of emergency declared in 17 states + DC

May 9, 2021:
  └─ Colonial pays $4.4M ransom in Bitcoin
  └─ FBI later recovers $2.3M of the ransom

May 12, 2021:
  └─ Pipeline operations fully restored
  └─ Total cost: $4.4M ransom + millions in operational losses

Technical Failures:
  └─ VPN without MFA
  └─ Old/unused VPN account was still active
  └─ VPN credential found in a prior breach (credential stuffing)
  └─ No anomaly detection on VPN login (3 AM login from unusual IP)
  └─ No lateral movement detection after VPN access

Governance Failures:
  └─ No quarterly account review (orphan accounts)
  └─ No MFA policy for remote access
  └─ TSA had flagged pipeline cybersecurity gaps — no action taken
  └─ No mandatory cybersecurity standards for critical infrastructure

Regulatory Response:
  └─ TSA issued Security Directives for pipelines:
      1. Mandatory MFA for all remote access
      2. 24/7 incident monitoring
      3. Vulnerability assessment within 30 days
      4. Cyber coordinator designated for each pipeline
  └─ CISA established Joint Cyber Defense Collaborative
  └─ Biden Executive Order on Improving Cybersecurity (May 2021)

Traditional VPN:
  User → VPN → Internal Network → All Resources
  └─ User gets full network access (over-privileged)
  └─ Once on VPN, lateral movement is possible
  └─ VPN is easy target for attackers (wide attack surface)

ZTNA (Zero Trust):
  User → Authentication → Application Proxy → Specific App
  └─ User gets access to specific app, not entire network
  └─ No lateral movement (no network layer)
  └─ Application never exposed to internet (hidden)

Immediate (fix today):
  └─ Enable MFA on ALL VPN connections
  └─ Disable inactive/orphan VPN accounts
  └─ Review VPN connection logs for anomalies

Short-term (this quarter):
  └─ Enforce device posture checks (OS patch, AV, disk encryption)
  └─ Implement certificate-based auth
  └─ Deploy VPN with split tunnel for general users, full tunnel for sensitive roles
  └─ Set up VPN concentrator high availability

Medium-term (this year):
  └─ Migrate from legacy protocols (PPTP, L2TP) to WireGuard or OpenVPN
  └─ Implement anomaly detection on VPN logins
  └─ Consider ZTNA for high-risk or privileged access

Advanced:
  └─ Deploy ZTNA as VPN replacement for all users
  └─ Implement continuous authentication (beyond initial login)
  └─ Zero standing privileges — JIT (just-in-time) VPN access