Your VPN box is now the front door
The Ivanti attacks are another reminder: firewalls and VPN appliances are a favourite way in. Treat them like that.
This month it’s Ivanti: two zero-days in its VPN appliances, chained together and exploited widely before a full fix was out. Last year it was others. The pattern is clear. Attackers love the box that sits on the edge of your network.
Why? It faces the internet, it often has no antivirus or logging, and once you’re in, you’re inside.
What I tell clients:
- Know every edge device you own: VPN, firewall, remote access gateway, file transfer server.
- Patch these within days, not at the next maintenance window. Follow the vendor’s mitigations the same day if there’s no patch yet.
- If it was exposed while vulnerable, assume compromise. Run the vendor’s integrity check, reset the device and the credentials it stored.
- Send its logs somewhere else. On the box, they can be wiped.
- Limit what the VPN can reach. Not every user needs every server.
The appliance that keeps attackers out deserves the most attention, not the least.