![vpns business secure](https://www.techfinitive.com/wp-content/uploads/2024/06/6136d946-eb07-4327-9db5-c44e160f05a3.jpeg)
US federal agency warns that VPNs might not be secure enough for your business
Virtual Private Networks (VPNs) are hugely popular, both with consumers looking to enhance privacy and organisations wanting to give remote employees secure access to internal applications.
Perhaps unsurprisingly, VPNs are also much loved by cybercriminals and nation-state hackers.
So loved, in fact, that the US Cybersecurity and Infrastructure Security Agency (CISA) has issued a stark warning.
It has “frequently identified” VPNs being involved in high-profile security incidents, adding more than 22 Common Vulnerabilities and Exposures (CVEs) to the Known Exploited Vulnerabilities (KEV) list.
These have led, the CISA says, “to broad access to victim networks” and are “prompting some to consider replacing their legacy VPN solutions with modern network access solutions”.
In the last few months alone we have seen:
- Chinese nation-state actors execute at least 85 attacks against Taiwan-based organisations, exploiting known VPN vulnerabilities
- Vulnerabilities in Cisco VPN web servers
- Vulnerabilities in Ivanti VPN appliances
- Vulnerabilities in the Pal Alto GlobalProtect VPN
- The arrest of a Chinese national involved in deploying malware via free VPN applications that created the world’s largest botnet, comprising more than 19 million unique IP addresses
Related: What are VPNs anyway?
How to make your business’ VPNs more secure
CISA says that “while some VPN solutions are inherently more secure than others — and not always the cause of major cyber incidents — current hybrid networks require adopting modern network access security solutions to help organisations protect corporate resources.”
The kind of Secure Access Service Edge (SASE) and Secure Service Edge (SSE) solutions that the CISA guidance references offer, according to Adam Maruyama, Field CTO at Garrison Technology, “more granular, context-sensitive controls” and so provide “additional layers of protection to organisations in the event of a breach”.
However, Maruyama warns that SASE and SSE software retains some residual risk.
“Just as attackers found vulnerabilities to exploit in the Internet-facing attack interfaces of VPNs,” Maruyama says, “so too will attackers find ways to subvert the software mechanisms enforcing the SSE and SASE controls.”
To counter these threats, Maruyama advises organisations to look toward verifiable, fixed-function security enforcement mechanisms “like those enforced by hardware security technologies” for critical security functions.
NEXT UP
![Intel Gaudi 3 on IBM Cloud - chip shot of Gaudi 3](https://www.techfinitive.com/wp-content/uploads/2024/08/HERO_Realistic-shot_Intel-Gaudi-3-AI-accelerator.jpg)
Intel’s Gaudi 3 AI accelerators set to launch on IBM Cloud in early 2025
Intel has announced plans to make its Gaudi 3 AI accelerators available on IBM Cloud in early 2025, suggesting that next year Nvidia will have tougher competition than ever before.
![Kris De Coorde Sport Vlaanderen](https://www.techfinitive.com/wp-content/uploads/2024/08/Kris-De-Coorde-Sport-Vlaanderen.jpg)
Kris De Coorde, Policy and Innovation Project Leader at Sport Vlaanderen: “Social media is a vital part of the modern sports experience”
We interview Kris De Coorde, Policy and Innovation Project Leader at Sport Vlaanderen, the Flemish sports administration.
![Detecting DDoS attacks shown by robot arm in cyberattack war room](https://www.techfinitive.com/wp-content/uploads/2024/08/4108dfb8-4c01-46a4-b7d6-8fa0e08cf344.jpeg)
Detecting DDoS attacks: how to tell a real attack from fake news using AI and common sense
Dubious claims about downtime make it difficult to separate fake news from legitimate outages: here’s out to detect genuine DDoS attacks, writes Donny Chong