According to CSO Online, the biggest threats of 2020 will likely continue in 2021, and organizations need to review their defensive strategies to combat these ongoing threats.
Ransomware Can Spread through VPN
Of the nine threats identified by the CSO Online article, the increasing use of employee-owned devices for remote work without adequate safeguards should be of special concern. This concern should be extended to all computers (including corporate-owned computers) that connect to corporate networks over VPN.
Essentially, VPN-connected computers are part of the corporate network. Therefore, when ransomware attacks remote computers connected by VPN, the attacks can spread through the VPN into the corporate network. Using a corporate-owned computer for remote access over VPN does not minimize this risk since computers inside a corporate network with tighter security often get compromised.
In the current scenario where about 70% of employees do some form of remote work, the gaping limitations of VPN should no longer be overlooked.
The Zero Trust Approach
VPN, as currently implemented, is too trusting of connected devices. A better approach pioneered by Google (BeyondCorp), commonly called Zero Trust is a much safer method for remote work. Zero Trust is not a product. Rather, Zero Trust is an information security framework which states that organizations should not trust any entity inside or outside of their network at any time. Therefore, there are different implementations of the framework based on an organization’s goals.
For example, organizations that use VPN to allow remote employees or contractors to connect to Windows computers or Windows applications may consider a solution such as Intelligent Networks SecuRemote SecureRDP does not allow lateral movements between remote and corporate network and includes multifactor authentication.
Full CSO Online Article – https://www.csoonline.com/article/3489045/2020-cybersecurity-trends-9-threats-to-watch.html