Closing the security gap in the supply chain

VPNs are an effective way to share data

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

Businesses are naturally trusting of their suppliers, often developing long-term partnerships. However, over the last few years, the supply chain has become a major target for cyber-criminals, seeking to exploit the soft underbelly often created by such relationships. Aside from any data leakage or social engineering risks resulting from an insecure supply chain, many businesses elect to deploy a persistentVirtual Private Network (VPN)connection between organisations, without realizing the inherent risks involved. If poorly implemented, a persistent VPN connection can pose a critical security risk for even a well-secured organisation.

Thomas Owen, Head of Security at Memset

VPNs are an effective way to share data across multiple networks in a secure way, enforcing the confidentiality and integrity of the data in the tunnel. However, in many cases, VPNs are the only data security measure put in place around the data being transferred. This creates a significant vulnerability which attackers can exploit.

This is because VPNs create a tunnel between distinct networks, much like a literal physical connection. If an attacker can compromise a host on one end, then a VPN can act like an opaque conduit to wherever the other end has been placed, even if this is deep inside an otherwise effective security architecture. Whilst the customer may have strong security controls this may not be the case with the supplier, thereby inviting attackers into the soft underbelly of your digital estate.

Persistent threats

VPNs have also been the recent target of Advanced Persistent Threat (APT) actors and the National Cyber Security Centre (NCSC) has published warning and advice to organisations on how to detect malicious activity, showing the growing vulnerability of this technology. To put it simply, a VPN is only as safe as it’s configuration and the additional security measures in place around it to manage the traffic traversing it.

There are a huge range of modern business-oriented VPN technologies available — from vendor-specific implementations from yourfirewallornetwork monitoringvendor, through to dedicated appliances and strong open-source contenders like OpenVPN and Strongswan. However, industry has seen cases across more legacy VPN protocols — particularly PPTP and L2TP without the IPSEC encryption — where historical implementation decisions have hurt security in the modern world. So, it would be advisable to opt for modern, well-known protocols and vendor technologies.

Maximum security

For maximum security in any IPSEC-based VPN, businesses should avoid aggressive modes and ensure that both AH and ESP are enabled. They should also consider disabling ISAKAMP and IKEv1 for security associations (IKEv2 is currently fine). ForOpenVPNand other TLS-based options, businesses should understand the potentially game-ending weaknesses that can exist within the underlying TLS/SSL ciphers and act accordingly.

For maximum security (but potentially tricky interoperability) go for something like TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384, AES-256-GCM as the cipher is solid and consider Curve25519 for DH exchange instead of the more NIST-y alternatives. If you want something exciting, try looking into ChaCha20-Poly1305 AEAD.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

For today’s SMEs, a ‘defence-in-depth’ approach is the only true path to achieving meaningful security. The approach combines multiple layers of controls which support one-another, while an attacker has to defeat or circumvent multiple layers of protection across applications, hosts and networks.

Such a judicious mix of security layers, including host hardening, firewalling, network segregation and content inspection of the data exiting and entering the VPN, will ensure not all elements of an organisation’sIT infrastructureare breached at the same time. This not only provides more time for detection and response, but also reduces an organisation’s ‘low hanging fruit’ appeal for passing cybercriminals. Further, don’t blindly trust the traffic exiting a supplier’s VPNsecurity endpoint, keep VPNs in the DMZ and subject to the same controls that any other inbound public connection would have.

GDPR

I hate to bang the GDPR drum, but securing organisational data has become even more important. An inappropriately deployed third-party VPN connection, successfully exploited during an attack would be contrary to the ‘taking into account the state of the art’ approach defined by Article 32, potentially reducing the effectiveness of an otherwise well secured, investment-intensive security strategy to nil.

As the new norms require data processors and controllers to share liability, businesses must think twice about the network and endpoint security of the supplier before sharing any data or providing access into their network. Opting for a defence-in-depth approach that includes the deliberate location and management of VPNs in your estate can help businesses stay resilient and afloat in the face of a cyber threat,malwareattack, or in the aftermath of a breach.

VPNs are legitimate, useful security tools but they should be used with great care. Taking a ‘secure by design’ approach and integrating VPNs as part of a layered security strategy can make it easier for organisations to engage with their supplier chain, leveraging the business benefits whilst maintaining protection.

Thomas Owen is the Head of Information Security & Risk at Snyk. He is a cloud-literate, innovative and strategic IT and security leader with a blend of people, policy and technical experience. Thomas is able to articulate and engage at all levels of the business, from a SOC analyst or DevSecOps to the Board and believe that success is built on empathy, respect, collaboration and communication. He aim to be an agent of positive change and enable business performance and growth, whilst allowing the board to better understand, articulate and address their real risk posture.

Mozambique VPN usage soars as internet restrictions continue

Retail and tech firms are hackers' most wanted targets – here’s what you can do about it

Arcane season 2 was reportedly going to run for five seasons, so why is my all-time favorite Netflix show ending after two?