CERT-In Advisory
CIAD-2020-0018
Securing the Enterprise Virtual Private Network (VPN)
Original Issue Date: April 11, 2020
Severity Rating: High
Description
The Coronavirus pandemic has led many organizations worldwide to restrict their employees from coming to work in office and have advised them to maintain social distancing and to continue working from the safe environment of their homes.
Organizations are using Enterprise VPNs for communicating through emails, video conferencing and other chat tools. A virtual private network (VPN) enables communication through secure online servers using encryption of data. With a large number of organizations using VPN for business continuity, attackers are finding vulnerabilities to target organizations for various cyber attacks. Therefore, organizations should set up a system in coordination with their IT staff to secure the VPN service to maintain business confidentiality, integrity and availability.
Best Practices for using VPNs
- Updating with latest software patches
Organizations should monitor the VPN server for any vulnerabilities and fix them at the earliest with the latest software patches and security configurations. Further, with many employees using VPNs, organizations are adding more VPN servers to minimize the surge in traffic. The IT staff should check whether the new VPNs installed are updated with the latest software.
- Increasing remote access cyber security tasks
Organizations should advise their IT team to increase scrutiny of unauthorized activity using log analysis, detect attacks in a timely manner and respond to incidents.
Organizations should also check their systems for DDoS attacks on VPN servers. An attacker could conduct various DDoS attacks leading to crashing of the VPN server. Such attacks could also limit/cut-off system administrators from the servers leading to further compromise of the internal attack.
- Alerting employees of increased phishing attempts
Pandemics like COVID-19 could lead to social engineering attacks. Employees need to be alerted about such attacks, where in fraudsters could pose as a genuine organization and send emails to obtain sensitive personal or organization level information.
- Enabling Multi-factor Authentication (MFA) for VPN accounts
To avoid any unauthorized activity during work from home, organizations should enable a multi-factor authentication (MFA) solution on all VPN accounts leading to better data security. In case, MFA can not be implemented, employees should be advised to use strong passwords to block any account takeover attacks.
- Testing VPN limitations for mass usage
IT personnel should test the VPN server for mass usage. Rate limiting should be encouraged so that priority is given to users who require higher bandwidth.
References
https://www.us-cert.gov/ncas/alerts/aa20-073a
https://www.zdnet.com/article/covid-19-with-everyone-working-from-home-vpn-security-has-now-become-paramount/
https://www.esecurityplanet.com/network-security/vpn-virtual-private-network.html
https://insights.sei.cmu.edu/cert/2019/11/vpn---a-gateway-for-vulnerabilities.html
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|