What are the best practices for remote network access?

Totally agree with Amy's comment "VPN aren't necessarily secure.” Ever monitored your VPN to see what traffic it DOESN'T send over the VPN? It wasn't until I started to monitor traffic sent over the VPN as part of developing our data exfiltration detection software, that I found out how little some VPNs send. In one case, a free VPN I tested only sent HTTPS down the pipe. Nothing else, just the already secured traffic. VPNs can easily be bypassed. Any hacker, or malware, who knows what they are doing, can divert traffic outside a VPN with little difficulty. Yes, its important to use a VPN, but as with anything in cyber security – don’t just believe the marketing hype; test it, know how it works.

VPN aren't necessarily secure and aren't all the same. Many free VPN's are actually ways to obtain your data. You must trust the VPN provider and the VPN endpoint. Where does your data travel to in that VPN tunnel? Consult with your IT department or MSP before selecting a VPN service.

Don't use a VPN and bring internal users into protected company network. Instead, allow users to do their job by accessing specific apps. For web apps, consider tools like GCP's Identity Aware Proxy or AWS Verified Access that allow you to expose specific applications to authenticated users. If you're not hosting your apps in the cloud or they are outside AWS or GCP, look at ZTNA solutions like Cloudflare Access that offers similar capabilities. Other options like AWS Session Manager or GCP OS Login allow specific users to access services without the need to manage ssh keys on users laptops. For more advanced users and tech savvy organizations, consider WireGuard or commercial solutions like Tailscale, Hashicorp Boundary or netmaker.

Understanding the fine print of a VPN and the user agreement is important for any user. With the growth of privacy concerns and the sale of personal information, a user needs to do research on the VPN provider itself. Some companies may provide a user’s personal data upon request to law enforcement, data mining, or general public access. While this is a broad statement, there are companies that do this. Free is not always good when choosing and high prices do not guarantee 100% anonymity. Nonetheless, VPN is the way to go.

Using a VPN is essential, but it's critical to understand that the configuration of your VPN is the most important factor in ensuring your online security and privacy. A VPN service is not a one-size-fits-all solution. It must be properly configured, with appropriate encryption protocols, server locations, and recommended privacy practices. A VPN is a powerful tool, but how well you optimize its settings for your specific needs, especially when connecting to public or untrusted Wi-Fi networks, determines its effectiveness.

An excellent example I have seen with Multi-Factor Authentication (MFA) is its usage in online banking. Many financial institutions have implemented MFA to provide an additional layer of security to their customer's accounts. This two-step process makes it significantly more difficult for cybercriminals to gain unauthorized access to the account.

Another alternative is hardware keys. It takes away the need for remembering passwords and adds the extra authentication. Granted, if they lose or damage it, it is a much bigger pain to replace than a MFA fob.

Implementing MFA is a smart move, and external encryption keys such as YubiKey should be considered as part of your multi-factor authentication strategy. These physical devices add an extra layer of security by requiring a tangible token, which is much more difficult for attackers to compromise than traditional methods such as passwords or codes. Incorporating such devices into your MFA setup can significantly improve remote network access security, ensuring that even if one factor is compromised, your network remains secure.

No one like Multi-Factor Authentication anymore than they like passwords. But you need to use is for EVERYTHING. And when given the option choose to have a code sent to an authenticator app rather than text. The criminals are doing a good job of intercepting and spoofing those. Nonetheless, we must persist. Even though it's an added step it is an important one. Think about it. Even your car doesn't trust you unless you have the right key fob.

I just got a text message from "cash app" with a 6 digit code. I haven't signed up for that. Somebody else did, attempting to use my phone number. Thank God for MFA

It is critical to deploy a firewall, preferably an NGFW, to secure remote network access. NGFWs include features such as intrusion detection and deep packet inspection, which are useful for filtering and monitoring traffic, detecting unauthorized access, and keeping security logs. This improves real-time threat detection and response while also ensuring internal network security, particularly in VPN scenarios.

The proper configuration of a VPN also includes setting policy and protections on what types of data can be transmitted through it and to where. Without that, let's say you log in from home to your work computer. A badly configured VPN will transmit everything from that home computer to the business, including malware.

It is critical to choose the right encryption method for VPN security on a remote network. Not all encryption methods provide the same level of security; some previously safe options have been compromised, putting data confidentiality at risk. Prioritize encryption methods that have been endorsed by the cybersecurity community, and stay up to date on the latest standards and algorithms. Choose AES-256 (Advanced Encryption Standard with a 256-bit key) over outdated protocols like PPTP or L2TP, which are known to have vulnerabilities, to ensure top-tier security for your VPN data.

One of the mistakes that I see business owners make most often, is not training entry level workers. They are the easiest targets and while they might not have the critical information the criminals are after, they are the point of access into the corporation and are often targeted with social engineering.

Kevin Mitnick's stories, as a notorious hacker turned cybersecurity consultant, are compelling examples that highlight the critical role of user education in enhancing security. His experiences, particularly the "Breaking into a Bank" story, vividly demonstrate the art of social engineering and the risks involved. Mitnick cleverly cloned an access card using cunning manipulation and some hidden-in-plain-sight hardware. Such stories provide valuable insights into the importance of user awareness in recognizing and mitigating threats, emphasizing the critical importance of comprehensive user education in bolstering security measures.

This is the most important point. It doesn't matter what devices you buy or what services you use if the end users don't use them properly. Practice over products. Find a good policy that is reasonably secure and simple, train the users on it, make sure to enforce it.

This is so critical. Always say YES to updates as they happen. Set updates to automatically install and look for that option in all of the software you use. When you install updates and stay current, problems are actually avoided. I see more cases of problems occurring when trying to catch up, then from those that just keep up.

I wouldn't run every update the minute it comes out, but you should do it regularly. Set a weekly schedule or something to run the approved updates. Just make sure they won't break anything vital to your company first.

One excellent example of the importance of updating comes from the EternalBlue patch in the context of the WannaCry attack. EternalBlue (CVE-2017-0144) was a zero-day vulnerability in Microsoft's Windows operating system that served as the entry point for the WannaCry ransomware in 2017. Notably, Microsoft had issued a patch, known as MS17-010, to address this vulnerability well before the WannaCry attack. Nonetheless, many unpatched systems remained vulnerable, resulting in the ransomware's widespread impact. This serves as a stark reminder of how important timely software updates are in protecting systems from potentially disastrous threats.

Use a VPN solution that has endpoint interrogation. Set a standard health requirement for systems to connect to the corporate backbone. If using public terminals has a VPN solutions that reverse proxies connections so the endpoints don't have direct access to the internal resources.

Access control is crucial for enhancing remote network security. It forms the foundation of network security measures, regulating access to resources and data to prevent unauthorized intrusions and data breaches. By defining and enforcing access policies, organizations ensure that only necessary personnel, such as employees, contractors, and partners, have access to specific resources. This improves security and minimizes the risk of sensitive information exposure. Access control is an essential component of a robust remote network access strategy, providing a framework for precise network entry regulation.