Virtual Private Networks (VPNs) are often viewed as essential for secure remote access, but for many organizations, they can introduce unnecessary risks. It’s important to evaluate whether a VPN is truly needed or if it’s something used only occasionally or rarely.

Understanding the risk with VPNs

VPNs represent major entry points into networks. Many people believe using a VPN means their Exchange server isn’t exposed to the internet. In reality, it just means the VPN itself is exposed instead. If there’s a vulnerability in the VPN, attackers could potentially access the entire network.

This risk became especially evident during the Log4j vulnerability, where flaws in various VPN platforms allowed attackers to create accounts and gain unauthorized access.

When to disable your VPN

If you have no real need for a VPN, turn it off. Most organizations now operate largely in cloud environments. While there may be occasional needs, such as accessing a single on-premises server, these use cases can often be addressed without full network access through a VPN.

Making your VPN more restrictive (if you must use it)

If a VPN is absolutely necessary, take steps to limit its exposure:

• Limit by connection source: For example, if your VPN is used for a development environment, restrict access to known IP addresses from the office or authorized home locations. This reduces risk from random or international connection attempts, such as while traveling.

• Geographic restrictions: If your firewall supports it, block VPN access from countries where you don’t operate. This helps reduce the attack surface.

• Implement VPN ACLs (Access Control Lists): Configure the VPN so users can only access what they need. If a user only requires access to email, ACLs can limit them to that system alone.

• Use secure web servers with dynamic ACLs: Instead of granting broad VPN access, publish a secure web server protected by multi-factor authentication and dynamic ACLs. These systems can detect a user’s IP address, open only the necessary web ports (e.g., port 443) when accessed from an approved location, and close them automatically when the user is offline.

Key takeaway

Disabling VPNs that are no longer necessary reduces your attack surface and aligns with Zero Trust principles by eliminating unnecessary entry points. For VPNs that must remain in use, apply strict access controls and geographic restrictions to reduce exposure.

Like what you see? There's more.

Dive into ThreatLocker webinar series 100 days to secure your environment today.

‍

‍