Five percent of VPN solutions remain unpatched and vulnerable
In 2020 we saw a huge shift to remote working, with VPN often the technology of choice for keeping connections secure.
But a new Network Security Report from SpiderLabs at Trustwave reveals that this trend didn't go unnoticed by cybercriminals, with malicious actors targeting unpatched VPN vulnerabilities more frequently.
More worrying is that by the end of 2020 five percent of VPN solutions remained unpatched and were still vulnerable to several of the most prominent VPN common vulnerabilities and exposures (CVEs). Indeed some had yet to be patched for a two-year-old Fortinet FortiOS SSL VPN path traversal vulnerability that can allow attackers to steal login details.
Prutha Parikh, senior security research manager, says on the Trustwave SpiderLabs blog:
VPNs take what we call a 'perimeter-based' approach to security -- trusted users on the inside and untrusted users on the outside. This approach was somewhat sufficient pre-pandemic with firewalls and other security solutions protecting office workers.
But, when the dramatic shift to remote work happened a year ago, it highlighted some of the challenges that came with this perimeter-based model of security that VPNs relied on. Employees were connecting into corporate networks from multiple locations, sometimes through bring-your-own-devices (BYOD) and unmanaged devices while on their home networks. This de-centralized workforce created a very large enterprise attack surface for VPN solutions. The access-to-all-or-nothing motto is the reason a VPN compromise can be extremely dangerous. Once an attacker is on the corporate network, they have access to everything. So when an attack occurs, the damage could be significant.
The report also looks at the Solar Winds supply chain attack, which it terms, 'probably the most crippling and devastating breach of the decade'. It highlights that businesses need to have in place a defense in depth approach to deal with issues when prevention of an attack fails.
You can find out more and get the full report on the Trustwave blog.
Photo credit: Roobcio / Shutterstock