Why bad use of a VPN can be dangerous?

Why bad use of a VPN can be dangerous?

VPN not-great for everything?

I don’t know if you heard about a high-profile case several years ago related to an ongoing investigation of unauthorized code found in Juniper software. It acted as a gateway to launch a cyberattack on the devices that worked under it. The report concluded that most likely an unauthorized software vulnerability had been placed there on purpose. It was designed in a way so it’s really difficult to detect it. Bloomberg has recently been informed about new facts related to the Juniper case.

Does a VPN make sense?

Why am I writing about this and how does this relate to the strong authentication that we deal with at Secfense on a daily basis? We observe that in many cases, and especially in the now widespread remote work, companies trying to adapt to the new reality use VPNs to let external employees into their network. This can be dangerous. And although VPN has a wide range of uses, and only one of its roles is to let outsiders into applications, Juniper has found this to be harmful. If the company decided to put the application outside and just protect it with strong authentication, the attack surface would be much smaller.

VPN has a wide range of use cases, and only one of them is to let users from the outside network inside the application.

When to use VPN?

Conclusion?

Po pierwsze, stosowanie VPN-a do wszystkiego, co możliwe jest nie tylko nieefektywne, ale również niebezpieczne. Po drugie, „rozciąganie” go na zabezpieczanie aplikacji webowych jest zupełnym zaprzeczeniem zasad projektowania efektywnego cyberbezpieczeństwa, które właśnie ze względu na różne podatności i backdoor-y, powinno budowane być warstwowo, czyli na tzw. cebulę i w sposób dywersyfikujący metody zabezpieczeń. 

I encourage you to dive deeper into this and learn more about the zero trust methodology and easy implementation of strong authentication, which we User Access Security Broker helps with.

Read More

Leave a Comment

Your email address will not be published.

Testimonials

„We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.”

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Polska

“Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.”

Dariusz Pitala

Head of IT

MPEC S.A.