VPNs in plain English
The internet is a public network. Data traveling across it could be intercepted at many points along the way. A VPN solves this problem: it builds an encrypted tunnel between two endpoints, such as a laptop in a home office and the corporate network.
Picture an armored courier van driving on public roads. Anyone can see that a van is on its way, but no one can look inside or swap anything along the route. At its destination, the gate to the company premises opens – and that gate is exactly what you need to guard well.
This article is about corporate VPNs. Consumer VPN services, which are mainly used to hide the user’s location, work in a technically similar way but serve a different purpose.
How a VPN works
At its core, a corporate VPN consists of three components:
- VPN gateway: a device or service at the edge of the corporate network that can be reached from the internet and accepts connections – the gatehouse, so to speak.
- VPN client: software on a laptop or smartphone that establishes the connection.
- Authentication and encryption: the user and the device authenticate themselves, and the data traffic is then encrypted. Common standards are IPsec and TLS; TLS also protects connections to websites, as indicated by “https” in the address bar.
There are two main types: with a remote access VPN, individual users connect to the corporate network. With a site-to-site VPN, entire locations are permanently connected, such as headquarters and a branch office.
Once logged in, the device often behaves as if it were in the office. That’s convenient – and at the same time the core problem: anyone who cracks the VPN access ends up right in the middle of the network, too.
A practical example
A logistics company has its network tested. Three things stand out at the VPN access point: the gateway software is outdated, and a critical vulnerability is publicly known for this version. A username and password are all it takes to log in. And anyone who is connected can reach not only the project drives but also the accounting servers and the warehouse management system.
Each issue on its own seems manageable. Together, they create a direct path from the outside into the heart of the network. The company installs the update, introduces multi-factor authentication (MFA) – which requires a second proof of identity in addition to the password – for all VPN access, and restricts access to the systems that each role actually needs.
Why does this matter for businesses?
VPN gateways can be reached from the internet around the clock. Attackers use automated tools to search for vulnerable devices, and once a new vulnerability becomes known, attacks often begin very quickly. Flaws in VPN products have been exploited on a massive scale time and again in recent years; unpatched VPN access points are among the typical entry points for ransomware.
Then there’s the easy route via stolen or guessed passwords, for example through password spraying: attackers try a few common passwords against a large number of accounts. Without MFA, a single weak password is enough. And because many VPNs grant access to the entire network, an attacker can then spread unhindered.
How to protect your organization
- Patch promptly: Install security updates for VPN gateways as a top priority, and follow the vendor’s security advisories.
- Enforce MFA: Every VPN account needs a second factor – including accounts used by service providers and administrators.
- Limit access: Give VPN users access only to the systems they really need, and divide your network into zones (network segmentation).
- Switch off legacy protocols: Outdated protocols such as PPTP and weak encryption no longer have any place in your environment.
- Monitor logins: Analyze failed and unusual logins – for example, at odd hours or from unexpected countries.
- Check devices: Only allow company-managed devices with up-to-date software. In the long term, an approach based on the zero trust principle can complement or replace the traditional VPN.
How Rootsektor can help
In a Network & Infrastructure penetration test, we examine your VPN access from the perspective of an attacker on the internet: software version, authentication methods, and configuration – and what an attacker could reach on the internal network after a successful login. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. You can get a fixed-price quote after scoping via our Pentest Quote page.