Is a VPN protected only by a password enough?

No. A VPN with password-only sign-in lets anyone with a stolen, guessed or reused password into your network, and VPN credentials are exactly what phishing pages and password-guessing tools go after. Add multi-factor authentication (MFA) to the VPN before anything else, prefer an authenticator app or a hardware key over text messages, and disable accounts that have not used the VPN for months. Restrict who may connect at all, by group, and log sign-ins so that you can see attempts from unusual places. Keep the VPN appliance itself patched, because a flaw in the gateway can bypass the password entirely. NetSenX does not check VPN sign-ins; that is the job of the VPN and your identity provider. Where the segment behind the VPN is monitored, it flags what an intruder does next, such as scanning, lateral movement or beaconing, on every plan.

← All 40 questions on Remote work and exposed servicesAll topics