VPN from an attacker's perspective

VPN connections have long provided remote employees with access to internal networks. Their structural risk comes less from networking itself than from the implicit trust granted after connection. Broad access and limited visibility create blind spots in hybrid environments.

Explanation

A user connecting through VPN often receives IP-level access and is treated like a device on the office network. Traditional VPNs consider little context about identity, device security, location or the specific application required. Sessions may also remain valid after circumstances change.

Risk

Attackers steal passwords and session tokens through phishing, exploit internet-facing appliances and abuse delayed patching. Because VPN traffic is commonly trusted, lateral movement and exfiltration can remain unnoticed through encrypted channels.

Points to check

• IP-level access instead of application-level access.
• No contextual verification of user, device and location.
• VPN traffic treated as trusted by default.
• Long-lived sessions after context changes.
• Weak segmentation behind the VPN.

Approach

Grant access using identity, device health and behaviour. Move towards per-application access through ZTNA, allow only managed devices and correlate VPN, endpoint and network logging with UEBA. Introduce the model gradually, beginning with critical applications.

Conclusion

Traditional VPN architecture no longer fits a Zero Trust security model. Identity-bound, context-aware access is necessary to reduce broad trust and improve visibility across modern IT and OT environments.

Contact

Want to understand the impact in your own environment? Contact DeepBlue Security & Intelligence at info@deepbluesecurity.nl or +31 (0) 70 290 6 290.