VPN and remote access

A remote access VPN (virtual private network) is the gateway that connects an outside device to a company's internal network through an encrypted tunnel, once the user has authenticated. On May 7, 2021, Colonial Pipeline shut down its pipeline. In June its CEO, Joseph Blount, told the Senate the attackers had come in through an old VPN account that was still active, protected by a password alone, with no MFA (multi-factor authentication). The appliance itself is the other weak spot. An SSL VPN faces the internet by design, and every critical flaw published on a major vendor's box gets scanned for by attackers within days. Incident response reports put these appliances among the leading entry points for ransomware in 2023 and 2024. Citrix Bleed, in October 2023, even let attackers lift an already authenticated session token, so MFA stopped nothing. The underwriting questionnaire asks whether all remote access goes through MFA, contractors included, and how fast critical patches land on internet-facing equipment. The answer can be checked from outside. An attack surface scan sees the appliance's login page, its brand, often its version, and matches it against the catalog of exploited vulnerabilities. Since 2021 many markets have treated missing MFA on remote access as a knockout question; others still quote, with a sublimit or heavier coinsurance on ransomware. A practitioner's caveat: the "MFA on the VPN" box says nothing about forgotten accounts, and Colonial's was a dormant one nobody thought could still be used.