Remote access gateway (VPN): what it is and how it is attacked
The door staff use to reach the internal network from outside.
Also known as
- VPN
- VPN concentrator
- remote access
- Citrix
- NetScaler
- Ivanti
- Pulse Secure
- Fortinet
- FortiGate
- Palo Alto
- GlobalProtect
- SonicWall
- AnyConnect
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is internet-facing by definition and it leads straight inside, which is why it is a standing target.
How it gets attacked, and what reduces it
How it gets attacked
- Sign-in without a second factor
- A flaw in the appliance itself, frequently exploited before a patch exists rather than after one is ignored
- Persistence left behind on the appliance, which survives the patch that closed the way in
- Session tokens and stored credentials taken from the device and replayed elsewhere
What reduces it
- A phishing-resistant second factor, since a code or a prompt can be relayed in real time
- Patch urgently, and treat exposure before the patch as a compromise rather than a near miss: patching closes the way in and does not remove anything already placed
- After patching, run the vendor integrity check, hunt for persistence, and rotate every credential and session token the appliance held
- Keep the management interface off the internet, which removes a large part of this class outright
- Remove access when people leave, and reconcile the account list against the staff list
Where it sits
- Group
- Network · The paths traffic travels along.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- vpn-gateway
Reviewed . CC BY 4.0.
Others in network
- The internetWAN · public networkEverything outside your organisation's control.
- Routergateway · layer 3Sends information from one network to another, the way a junction sends cars down different roads.
- Switchlayer 2 · LAN switchConnects the devices inside one building or floor, passing each message only to the machine it is addressed to.
- Address rangeCIDR · subnet · IP rangeA group of numbered addresses on a network, written as a single line such as 192.0.2.0/24 rather than listed one by one.
- Internet network operatorASN · autonomous system · AS number · BGP network · peeringOne organisation's own network on the internet, identified by a number so every other network knows whose it is.
- Domain nameDNS name · registrar · domain registration · registrant · domain recordThe name the organisation owns, and the account at the registrar that controls it.
The network group lists all 7 of them side by side.
Remote access gateway on your own diagram
Open the editor, press N, and type VPN. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker