VPN Security Risks for Business Applications

VPN security risks, for a business, are what a firm carries when staff reach company applications over a VPN. That VPN connects them to the whole network. Five show up. The first four are network-wide reach, a password as the only check, devices that nobody checks and exposed appliances that need urgent patching. The fifth is a slow connection that pushes staff towards workarounds.

This article covers business risk, not the privacy of a consumer VPN app. It does not cover the fix or what to buy. If you want the aim, see securing remote access to business applications. For the worker’s own laptop and home set-up, read about keeping remote workers’ devices and home set-up safe. Zero trust network access is another way to give people access, one application at a time. The page on how zero trust access works explains it.

Which VPN Security Risks Matter for Business Applications?

Five risks matter for business applications, and each one leaves a sign a firm can check. The table below sets out what each risk means for an application and what it looks like inside a firm.

The next sections take each risk in turn, with the signs to look for. The same risks can apply to a five-person team and a five-hundred-person firm, although the cost can grow with the number of people and applications.

How Does a VPN Give One Login Network-Wide Reach?

Once connected, a person can see more of the network than the job needs. A finance analyst who needs one reporting application can still reach file servers, the finance database and backups. The VPN joins the laptop to the network, not to the application. Our step-by-step guide to setting up access one application at a time shows how to change that.

Reach is the first risk to check. In our reading, one stolen login opens the same wide door for an attacker. From inside, the attacker can then look around. Security teams may also see little of what happens inside the encrypted tunnel. That is a point to verify in your own logs. A closer look at lateral movement shows how that looking around can turn into a spread.

The idea that network location should not earn trust is not new. NIST’s Zero Trust Architecture (SP 800-207) states that zero trust assumes no implicit trust for assets or accounts based only on network location. A VPN connection is, after all, a network location.

Signs that reach is a problem:

• Users on the VPN can reach servers unrelated to their work.
• One access policy covers every group.
• Nothing restricts access by application or role.

What Happens When a Password Is the Only Check?

When a password is the only check, a stolen or reused password becomes full VPN access. Nothing in the VPN itself stops a login that looks valid. The VPN then treats the attacker as the employee.

Phished passwords and passwords reused from another site are a way into a firm’s network. We have no figure for this, so treat it as our judgement. A multi-factor authentication step adds a second proof of identity, and its absence is the gap this section describes.

Signs that a password is the only check:

• Some VPN accounts have no second sign-in step.
• Teams use shared logins for remote access, so nobody can say who connected.
• Remote desktop is reachable from the internet with a password only.

Why Do Unchecked Devices Add to VPN Security Risks?

A VPN connection on its own does not tell a healthy laptop from an infected one, so both get the same trust. Malware on a compromised device can travel through the tunnel into the company network. That also gives the problem a second path next to a stolen password.

A device that has missed updates or lost its security software still connects, because a VPN may check who signs in without checking what they sign in from. A device posture assessment is the check of a device’s state, and its absence is the gap.

Signs that devices are unchecked:

• Personal computers connect to the VPN.
• No health check runs before the VPN grants access.
• The VPN treats out-of-date devices as trusted.

Why Does an Exposed VPN Appliance Keep Turning Into Urgent Work?

The appliance faces the internet, so a serious flaw means emergency patching and unplanned downtime.

Old or weak settings and configuration mistakes can also expose the internal network. Running the appliance well takes skills that a small IT team may not have. The work arrives on the vendor’s schedule, not the firm’s. Those points are our judgement, not sourced findings, and we give no count of flaws.

Signs that the appliance is a risk:

• The team has applied emergency patches in the last year.
• The appliance is reachable from the internet.
• Updates wait because the team fears downtime.

How Does a Slow VPN Become a Risk?

When the VPN is painful to use, staff find their own ways to work, and nobody reviews those ways. A slow VPN looks like a comfort problem, but it changes what staff do with company data.

An employee who has trouble opening a large file over the VPN may email it to a personal account. Another person may drop the VPN and use a shortcut that IT has not seen.

Signs that slow sessions are a risk:

• Complaints about speed and dropped connections.
• Staff avoiding the VPN to finish a task.
• Files sent to personal accounts to get around a slow session.

At What Moments Do VPN Security Risks Become Visible?

They show up at three moments: a VPN flaw makes the news, someone phishes a password, or staff call the VPN unusable. Each moment turns a quiet weakness into a visible problem for the business.

Which of These VPN Security Risks Sit in Your Own Set-Up?

Each yes below points to a risk in your own set-up. Take the five questions in turn and answer them for your VPN as it runs today.

• Can a person on the VPN reach servers that have nothing to do with their job?
• Do any VPN accounts sign in with a password only?
• Do personal or unchecked devices connect to the VPN?
• Does the VPN appliance face the internet, and has it needed an emergency patch?
• Do staff complain that the VPN is slow, or avoid it to finish work?

A single yes proves no breach, yet it gives you a place to start. Several yes answers, or a question nobody can answer, are a reason to ask a specialist. To compare your options once you have answers, use the decision tables and supplier questions for choosing how staff reach applications. Fixes, product choice and a comparison of approaches sit outside this article. A comparison of a tunnel with checks at each application is in our guide on SASE against a VPN. To put a score and evidence behind your own answers, work through twelve pass or fail checks on how people reach applications.

Signisys provides cybersecurity and identity services through its Identity and Access Management solution and its Cybersecurity services. The use cases on Secure Remote and Hybrid Workforces and Secure Third-Party and Vendor Access cover nearby ground.

VPN Security Risks FAQ: Quick Answers