The Remote Access VPN Is No Longer Fit for Purpose

At one point a heavy stone against the door was how a household kept intruders out. Then came the wooden latch, then the lock and key, then the Yale cylinder lock, then the five-lever mortice lock, then a safety chain on the inside, and eventually a door with locking points along its full height. Alongside the locks the same thing happened with detection: nothing at first, then a dog, then an alarm, then cameras. Nobody moved to the next stage for the sake of it. Each step was taken because the previous one had been understood, worked around and beaten often enough that it no longer did the job it was bought for.

Access to business systems has followed the same path. Systems were once simply switched on. Then came the password, then multi-factor authentication, then the VPN to reach the network from outside. Each of these was the right answer when it arrived. Each one was then studied by attackers, compromised at scale and quietly demoted to a baseline. The VPN has now reached that point, and it is time to say so plainly.

Why the VPN has been beaten

A VPN was designed to extend the office network to a remote device. Once connected, that device has much the same reach as a desk inside the building. Attackers understood this a long time ago. Stolen or phished credentials give them the same reach as the employee, which is why the remote access gateway appears as the initial entry point in so many ransomware investigations. The gateway itself has to sit on the internet in order to function, and over the past few years these appliances have been among the most heavily exploited devices anywhere, with vulnerabilities being used in live attacks within days of disclosure and sometimes before a patch exists.

Adding MFA in front of the VPN helped, in the same way that fitting a chain helped the Yale lock. It did not change what the VPN does once someone is through, and MFA itself is now routinely bypassed through session hijacking and push fatigue. The problem is the model. A VPN opens the network to a device on the strength of a login. That was acceptable when the threats were less capable and the network held everything. It is no longer acceptable when the network is a target in its own right and half of what staff need sits in cloud services anyway.

The next lock

The current generation of remote access, generally described as SASE or secure service edge, changes what is being protected. Rather than admitting a device to the network, it connects a verified person on a checked device to the specific applications they are permitted to use, and it makes that decision on every request. If credentials are stolen, the attacker reaches a handful of applications rather than the estate. A device that is missing patches or has its protection disabled is refused before it connects. Contractor access is switched on for the engagement and off at the end. There is no appliance on the internet for attackers to probe, because the gateway has gone.

This is the multi-point locking door with the cameras running. It will be beaten in turn one day, as everything is, but it is several stages ahead of where most Irish organisations currently sit.

Insurers have already moved

Cyber insurance renewal forms in Ireland now ask how remote access is secured, and the wording separates access based on identity and device health from a traditional network VPN. Customer questionnaires from organisations in scope of NIS2 or DORA ask suppliers the same. Partners helping customers complete these forms tell me that describing a VPN with MFA, which was a strong answer three years ago, now reads as a description of the older model. The insurers have moved on from the VPN. The organisations that depend on one have not.

Where to begin

The first step is a list of the applications remote users actually need, where those applications live and who needs each one. That list is the design for what replaces the VPN and it is also the answer to the questionnaire. The second is an honest look at what the current gateway exposes and how many accounts still hold access they no longer need. Renaissance and our partners across Ireland can work through that assessment with you, or with a customer, before any decision on technology is made.