The (CISA) U.S. Cybersecurity and Infrastructure Security Agency and the (NSA) National Security Agency have released guidance for hardening the security of virtual private network (VPN) solutions.
The two agencies created the document to help organizations improve their defenses particularly against attacks from nation-state adversaries, who in the past have exploited bugs in VPN systems to “steal credentials, remotely execute code, weaken encrypted traffic’s cryptography, hijack encrypted traffic sessions, and read sensitive data from the device.”
“Multiple nation-state advanced persistent threat (APT) actors have weaponized common vulnerabilities and exposures (CVEs) to gain access to vulnerable VPN devices,” the U.S. National Security Agency
The document provides direction for selecting VPN solutions that follow the industry standards and the best practices for using strong authentication credentials.
An advisory from the U.K. National Cyber Security Centre (NCSC) in May added appliances from Cisco and other network gear vendors to the list of products with vulnerabilities that SVR hackers exploited.
Ransomware gangs have also shown a massive interest in this type of network access vector. At least seven operations have exploited bugs in VPN solutions from Fortinet, Ivanti (Pulse), and SonicWall.
Cring, Ragnar Locker, Black Kingdom, HelloKitty, LockBit, REvil, or Conti ransomware operations have breached dozens of companies by exploiting VPN security issues.
TAKEAWAY
As general rules for hardening the VPN is by reducing the server’s attack surface by:
Configuring strong cryptography and authentication
Running on strictly necessary features
Protecting and monitoring access to and from the VPN
Cybercriminals are always finding new ways to hack. As Cybercriminals find more ways to infiltrate and steal data, businesses must strengthen their security to stay safe from these cybercriminals.
Comments