A VPN is one gate, not a wall. The breaches that start at VPNs are almost never about the encryption — they are a stolen password without MFA, an unpatched appliance, or a contractor account nobody turned off.
This note is the checklist I wish came with every VPN subscription. Five honest parts:
1. MFA on every account — including the one you forgot. TOTP or passkeys on every human login, never SMS for admins. And the vendor/support account counts: most appliances ship with one. Rename it, MFA it, park the password in the manager — or disable it in writing.
2. Patch the concentrator like a server. VPN gateways are the most profitable breach entry point of recent years — the same four vendors in every headline, and the cause is usually a patch that sat for weeks. Emergency lane (24h) for exploited CVEs, management UI never on the internet, EOL check once a year.
3. Full tunnel vs split tunnel — decided in writing. One sentence per group: admins and contractors full tunnel, vendors split and restricted to one host and one port, general staff by written decision. Then verify with a route check, not a feeling.
4. Least privilege behind the gate. Finance doesn't need your prod servers. Map each VPN group to firewall rules on one page, give vendor accounts one destination and an expiry date you chose, and match the user list to current staff quarterly — delete the delta the same day.
5. Retire the zombie accounts. The accounts that cause incidents are rarely new: ex-contractor logins, dormant TOTP phones, service accounts that somehow authenticate to the tunnel, the shared "office" login from before you knew better. Offboarding revokes VPN in the same hour it revokes email.
Bonus: the client owes you a kill switch (no silent fail-open), auto-connect on untrusted Wi-Fi, and client updates on the same patch wave. And five signals worth alerting on: auth-failure spikes, new-device logins, out-of-window appliance config changes, concurrent sessions from different countries, and dormant accounts that wake up.
The full checklist — with the quarterly review card and the group-to-firewall table — is on the site:
👉 VPN Security Checklist for Small Teams — part of the free HIVE80lab ops notes library.
If you want the surrounding system: the Ops Starter Kit ($14) covers incident response for small teams, the First 30 Minutes checklist is free, and the Automation Starter Pack ($19) makes the access reviews and patch waves run themselves.
💬 Discuss: What are your first 3 steps in an incident?
Top comments (0)