NSA, CISA share VPN security tips to defend against hackers

Опубликовано: 16 Май 2026
на канале: CSI digital

129

NSA, CISA share VPN security tips to defend against hackersOriginal article: https://www.bleepingcomputer.com/news... Private Networks (VPNs) allow users to remotely connect to a corporate network via a secure tunnel. Through this tunnel, users can take advantage of the internal services and protections normally offered to on-site users, such as email/collaboration tools, sensitive document repositories, and perimeter firewalls and gateways. Because remote access VPN servers are entry points into protected networks, they are targets for adversaries.The National Security Agency (NSA) and CISA have released the cybersecurity information sheet Selecting and Hardening Standards-based Remote Access VPN Solutions to address the potential security risks associated with using Virtual Private Networks (VPNs). Again, Remote-access VPN servers allow off-site users to tunnel into protected networks, making these entry points vulnerable to exploitation by malicious cyber actors.Exploitation of these devices can enable:• Credential harvesting• Remote code execution on the VPN device• Cryptographic weakening of encrypted traffic sessions• Hijacking of encrypted traffic sessions• Arbitrary reads of sensitive data (e.g., configurations, credentials, keys) from the deviceThe two agencies created the document to help organizations improve their defenses particularly against attacks from nation-state adversaries, who in the past have exploited bugs in VPN systems to “steal credentials, remotely execute code, weaken encrypted traffic’s cryptography, hijack encrypted traffic sessions, and read sensitive data from the device.”The document provides direction for selecting VPN solutions that follow the industry standards and the best practices for using strong authentication credentials.Avoid selecting non-standard VPN solutions, including a class of products referred to as Secure Sockets Layer/Transport Layer Security (SSL/TLS) VPNs. These products include custom, non-standard features to tunnel traffic via TLS. Using custom or non-standard features creates additional risk exposure, even when the TLS parameters used by the products are secure. NSA and CISA recommend standardized Internet Key Exchange/Internet Protocol Security (IKE/IPsec) VPNs that have been validated against standardized security requirements for VPNs. Organizations should also choose products from reputable vendors with a history of acting quickly to patch known vulnerabilities.Carefully read vendor documentation to ensure potential products support IKE/IPsec VPNs. Documentation for some products may not provide comprehensive information about the protocols they support when establishing VPN tunnels. Avoid products that do not clearly identify the standards they follow or claim to use proprietary methods to establish VPNs.Identify whether the product uses SSL/TLS in a proprietary or non-standardsbased VPN protocol when unable to establish an IKE/IPsec VPN.Ensure that potential products use FIPS-validated cryptographic modules and can be configured to use only approved cryptographic algorithms Check that a product supports strong authentication credentials and protocols and disables weak credentials and protocols by default.Research and select a vendor with a proven track record of supporting products via regular software updates and quickly remediating known vulnerabilities. Request and validate a product’s Software Bill of Materials (SBOM) so the risk of the underlying software components can be adjudicated. This means check the stuff that was jammed into the software to make sure you understand what other code (open source or not) are running this software.Ensure the product has a robust method to validate the integrity of its own code and regularly perform code validation.Ensure the product includes protections against intrusions, such as: • Use of signed binaries or firmware images • A secure boot process that verifies boot code before it runs • Integrity validation of runtime processes and filesAs general rules for hardening the VPN, the two agencies recommend reducing the server’s attack surface by:• Configuring strong cryptography and authentication (Configure the VPN to use IKE/IPsec and disable SSL/TLS VPN functionality and fallback options if feasible)• Running on strictly necessary features• Protecting and monitoring access to and from the VPN (for example deploy intrusion prevention systems, use WAF’s, )• Immediately apply patches and updates to mitigate known vulnerabilities that are often rapidly exploited (sometimes within less than 24 hours)