Securing VPN Access

ReliaQuest reports widespread exploitation of internet-exposed VPNs across sectors, outlining attacker pre-access reconnaissance (Shodan/Censys fingerprinting), credential acquisition (credential stuffing, password spraying, infostealers), exploitation of notable CVEs (Ivanti, FortiGate, Citrix, Cisco), and post-compromise activities (internal discovery, lateral movement, credential dumping, data exfiltration). The report emphasizes defensive measures—patch management, MFA and certificate authentication, strict access controls and segmentation, comprehensive logging, user training, and consideration of Zero Trust architectures—to reduce VPN attack surface and detect/respond to intrusions.