NSA, CISA Provide VPN Security Tips For Hacker Protection

Share post:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) have issued guidelines to improve the security of virtual private network (VPN) solutions.

Both agencies co-authored the document to help organizations improve their defenses against attacks by nation-state cybercriminals who exploited bugs in VPN systems to “steal credentials, remotely execute code, weaken encrypted traffic’s cryptography, hijack encrypted traffic sessions, and read sensitive data from the device.”

Organizations should also purchase products from reputable vendors who already have experience in fixing known vulnerabilities quickly.

Both agencies recommend reducing the server’s attack surface by:

  • Strong cryptography and authentication
  • Running on strictly necessary features
  • Protection and monitoring of access to and from the VPN

The guidelines come after financially motivated and state-supported cybercriminals have recently focused on exploiting VPN vulnerabilities to achieve their goal.

The attack vector has attracted government-backed hackers who leveraged vulnerabilities in VPN devices to enter networks of government organizations and defense companies in many nations.

Ransomware gangs have also shown a massive interest in this type of network access vector. At least seven operations have exploited bugs in VPN solutions from Fortinet, Ivanti Pulse and SonicWall.

Cring, Ragnar Locker, Black Kingdom, HelloKitty, LockBit, REvil or Conti ransomware operations have exploited the systems of many companies by exploiting VPN security issues.

For more information, read the original story in Bleeping Computer.



Related articles

Microsoft announces enhanced security feature for OneNote

Microsoft has released further information on the increased security measures it is deploying for OneNote in order to...

Google Drive rolls out new search filters

Google Drive has launched new search filters for users to quickly find and retrieve files. The new filters...

Russian hacker group steals Emails of NATO officials and diplomats

Since February 2023, a Russian hacking gang known as TA473 or 'Winter Vivern' has targeted unpatched Zimbra endpoints...

Nearly 70% of IT leaders to increase outsourcing

According to research performed by software development business JetRockets, almost 70% of IT executives are increasing their demand...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways