VPN Security: Beyond Basic Connectivity
VPNs remain critical for remote access and site-to-site connectivity, but they also represent a significant attack surface. Recent high-profile vulnerabilities in VPN products (Ivanti, Fortinet, Palo Alto) demonstrate that VPN infrastructure requires continuous security assessment.
VPN Security Audit Checklist
Protocol Assessment
- Verify modern protocols: WireGuard, IKEv2/IPsec, or OpenVPN
- Disable legacy protocols: PPTP, L2TP without IPsec, SSLv3
- Validate cipher suite configuration
- Check for known CVEs in VPN software version
Authentication
- Multi-factor authentication enforced
- Certificate-based authentication for site-to-site
- Account lockout policies for brute force protection
- Session timeout and re-authentication intervals
Split Tunneling Analysis
- Full tunnel vs. split tunnel risk assessment
- If split tunnel: verify what traffic bypasses VPN
- DNS leak testing (queries going outside tunnel)
- WebRTC leak testing for browser-based VPNs
Access Control
- Verify least privilege VPN access policies
- Network segmentation after VPN connection
- Time-based access restrictions
- Geo-blocking for unauthorized regions
Infrastructure Security
- VPN concentrator patch level
- Management interface access restrictions
- Log collection and monitoring
- High availability configuration
Common Vulnerabilities
- Unpatched VPN appliances with known exploits
- Default or weak pre-shared keys
- Missing MFA allowing credential stuffing
- Overly broad network access post-connection
- SSL VPN portal vulnerabilities
Where SuperClue Fits
SuperClue does not audit VPN configurations. Its DAST scanner can check an internet-facing VPN portal like any other web endpoint, including its TLS settings, exposed services, and known CVEs.