VPN appliance security for engineers: ten questions

Summary

This chapter takes the VPN appliance apart, one page per part: the code that answers before login, the access that outlives a patch, and the logs that a reboot or upgrade erases. It ends with ten questions about your own appliance that should be answerable from records.

Technical detail

Parts and pages

The lock itself, authentication including multi-factor authentication (MFA), is covered in chapter 3 and chapter 6.

Fig. 5-1The door detail from outside, each part keyed to the page that covers itNTS (not to scale)

The pre-auth surface: what the appliance exposes before login, and how to inventory and shrink it.
Patching is not closing: five ways an intruder’s access survives the patch, and the order of work when a KEV entry names your appliance.
Evidence before the reboot: where the appliance keeps its logs, and what a reboot, an upgrade or a factory reset erases.

Ten questions about your own appliance

An answer that depends on one person’s memory counts as missing.

#	Question	A complete answer	Why it is on the list
1	Who owns the appliance, and who patches it under the contract?	A named person, and a contract clause that makes the vendor pass on advisories and apply fixes	The Osaka committee found the responsibility split between the hospital and its vendors undefined (p.14). Handa’s reseller never passed the vulnerability notices on (technical volume, printed p.15).
2	Which firmware version is running, and when was it installed?	The exact version string, checked against the vendor’s PSIRT advisories	NPA: in 2025, 40 of the 71 victims who answered had an intrusion device with security patches missing.
3	When does vendor support end for this model and version?	A date, and a funded replacement before it	CISA, FBI and the UK NCSC: “Maintain an inventory of all edge devices and their respective support timelines.”
4	Can the management interface be reached from the internet?	No. Only from a separate management network	CCCS: “network management interfaces (NMIs) should not be directly exposed to the Internet.”
5	What second factor do VPN users and administrators use?	No password-only accounts; phishing-resistant MFA for administrators	39.8% of Japanese organizations NPA surveyed use ID and password only. Arctic Wolf saw logins to accounts with one-time passwords enabled.
6	Which accounts are local to the box, and when were their passwords last set?	A list with dates; nothing carried over from an old unit	SonicWall traced its 2025 wave to “local user passwords” that “were carried over during the migration and not reset.”
7	Where do the logs go, and how long are they kept?	Off the box to a SIEM, kept longer than a zero-day stays undisclosed	NPA: only 25 of 102 ransomware victims in 2025 kept all their logs; 18 answers named an expired retention period.
8	When was the appliance last checked for compromise, and with what?	A date, the tool, and a check that does not rely on the appliance alone	CISA: “Ivanti’s internal and previous external ICT failed to detect compromise.”
9	After the last KEV entry for this product, were credentials reset?	Yes, with a date, covering local accounts, the LDAP bind account, RADIUS secrets and users	Fortinet, on the 87,000 leaked devices: “if the passwords were not reset, they remain vulnerable.”
10	Is there a plan to stop exposing network-level VPN access?	A dated plan that treats ZTNA gateways as edge software too	CCCS encourages organizations “to move from overreliance on boundary protections like edge devices”. CVE-2025-0282 also affected Ivanti Neurons for ZTA gateways.

Source: Osaka General Medical Center, Information Security Incident Investigation Committee 「調査報告書」 (pp.11–12, 18–19, 36–41, 45–47; pp.11, 37, 45–46, 71)Tsurugi Town Handa Hospital, expert panel on the computer virus incident 「徳島県つるぎ町立半田病院コンピュータウイルス感染事案有識者会議調査報告書技術編」 (printed pp.9–11, 14–15; pp.10–14)National Police Agency 「令和８年上半期におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編p139, p143, p148, p153)CISA, FBI and NCSC-UK Reducing the Attack Surface for End-of-Support Edge Devices (p.1; pp.1–2)Canadian Centre for Cyber Security Security considerations for edge devices (ITSM.80.101) (ITSM.80.101)National Police Agency 「サイバー攻撃の被害に係る企業・団体を対象としたアンケート調査結果及び対策」 (p.1)Arctic Wolf Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or LessSonicWall 「Gen 7 and newer SonicWall Firewalls – SSLVPN Recent Threat Activity」National Police Agency 「令和７年におけるサイバー空間をめぐる脅威の情勢等について（統計データ）」 (sheets 統計編P122, P124, P126, P129, P130; sheets 統計編P137, P138)CISA and partners Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)Fortinet PSIRT Malicious Actor Discloses FortiGate SSL-VPN Credentials