Why Should You Protect Your VPN with MFA

Reason 1: Protection Against Credential Theft

Most hacking-related incidents, including ransomware attacks, happen due to stolen or weak passwords. And that includes the VPN.

In particular, VPN credentials are more susceptible to weaknesses, especially in small and medium-sized organizations, because of the lack of SSO (Single Sign-On, a single set of credentials for multiple internal services, allowing administrators to enforce password complexity). SSO can be expensive and complicated. Hence, most small and medium businesses do not implement SSO.

The absence of SSO and the inability to enforce strong passwords via policy settings blindsights the IT administrators. The IT team has no means to check whether a password used by an employee is strong or weak.

Layering MFA on top of a VPN defends against credential theft and weak passwords. The MFA verifies the identity of all users with a second factor before granting access. It protects against phishing or other access threats.

Reason 2: Compliance with Regulations and Standards

In many environments, securing VPN access is a compliance requirement, and MFA helps meet those requirements.

For example, if your company is implementing ISO 27001:2022, one of the requirements is the implementation of secure authentication procedures to prove the identity of the user.

The PCI DSS 3.2 standard prevalent in the payment card industry also mandates using MFA for all types of remote access, including VPN. Other compliance regimes, such as HIPAA and NIST 800-171, also have similar requirements for MFA.

Adding MFA with your VPN deployment reduces the risk of a security breach while helping you easily meet the compliance requirements.

Reason 3: Consistent Security Across Multiple Environments and Apps

VPNs facilitate remote access to on-premises applications and data. However, many organizations are moving some of their workloads to the cloud (the most popular being Microsoft 365 and Google Workspace). It creates a hybrid environment, with assets both in the cloud and on-premises.

A well-designed MFA solution ensures consistent security across on-premises and cloud applications, meaning the process for logging into the VPNs is the same as the process for logging into email, file sharing (e.g., OneDrive), collaboration (e.g., MS Teams), etc.

Reason 4: Gain Visibility Into All Devices

The Bring Your Own Device (BYOD) trend presents unique security challenges for businesses. Employees accessing corporate networks from personal devices may introduce vulnerabilities.

An integrated MFA solution provides valuable insights into which devices are accessing the VPN, their health, and even their location. You can see the security posture of all user devices, such as laptops, desktops, and mobile devices, including all personal devices—aka bring your own devices (BYOD)—that access cloud applications.

Reason 5: Enforce Granular Access Control and Security Policies

Some MFA solutions offer the ability to enforce security policies based on user and device risk. They enable businesses to implement granular security policies, including geofencing capabilities.

Geofencing restricts access to VPN resources based on the physical location of the user, adding an extra layer of protection against unauthorized access attempts from unanticipated locations or suspicious IP addresses.

For example, you can enforce a security policy for VPNs to allow access only from specific locations (e.g., India) and only from devices that have up-to-date software. This gives you a higher level of assurance before you grant a user or their device access to applications.

Duo Security by Cisco: An Integrated MFA Solution

We have partnered with Duo Security to bring the benefits of an integrated MFA solution to our customers at affordable pricing.

Duo Security (now part of Cisco) offers the best-in-class MFA solution that can secure access to all applications, for any user, from any device, and from anywhere.

Cloud-first organizations and those looking for a secure, rapid transition to the cloud use Duo to protect their on-premises and hosted applications, while securing their mobile workforce and their chosen devices.

Duo delivers a zero-trust security platform that enables organizations to base application access decisions on the trust established in user identities and the trustworthiness of their devices, instead of the networks from where access originates. Duo delivers this capability from the cloud and without reliance on outdated, cumbersome, and costly technologies.

Useful Links

• Duo Security
• How to Improve Security with SSO and MFA 
• MFA Everywhere: The Importance of Multi-Factor Authentication
• The Zero Trust Architecture

Related

• Safeguard Your Network with a Free Firewall