Full Report
Huntress Managed ITDR uncovers risks behind popular VPNs and proxies like NordVPN, Mullvad, and more—helping you steer clear of hackers this holiday season.
Analysis Summary
# Best Practices: Managing Risky VPN and Proxy Usage
## Overview
This guide addresses the security risks associated with the presence of consumer-grade VPNs and anonymous proxies (such as NordVPN and Mullvad) within a corporate network. While these tools offer privacy for individuals, they are frequently leveraged by cybercriminals to mask session hijacking, credential theft, and unauthorized access. These practices aim to minimize the "identity perimeter" risk and enforce corporate policy.
## Key Recommendations
### Immediate Actions
1. **Audit Installed Applications:** Scan all managed endpoints for consumer VPN software (NordVPN, Mullvad, etc.) and unauthorized proxy tools.
2. **Block Anonymous Payment Sites:** Block access to VPN provider payment pages and cryptocurrency payment gateways on the corporate network to discourage shadow IT.
3. **Implement Geo-Fencing:** Configure Conditional Access policies to block logins from countries where your organization does not have a physical presence or traveling employees.
### Short-term Improvements (1-3 months)
1. **Define and Enforce VPN Policy:** Update the Acceptable Use Policy (AUP) to explicitly prohibit the use of personal VPNs on company hardware.
2. **Deploy ITDR (Identity Threat Detection and Response):** Implement a solution to monitor for "Unwanted Access" trends, focusing on logins originating from known data center IPs rather than residential ISPs.
3. **Session Management:** Shorten session lifetimes for critical applications to mitigate the impact of session hijacking facilitated by these VPNs.
### Long-term Strategy (3+ months)
1. **Zero Trust Architecture:** Transition from traditional VPN-based access to a Zero Trust Network Access (ZTNA) model, reducing the need for broad network tunnels.
2. **AS-Based Detection:** Integrate Autonomous System (AS) monitoring to identify and flag login attempts coming from infrastructure/proxy providers rather than legitimate user locations.
3. **Continuous Managed Monitoring:** Partner with a 24/7 SOC to triage alerts involving "Impossible Travel" scenarios masked by high-privacy VPNs.
## Implementation Guidance
### For Small Organizations
- **Policy First:** Clearly communicate to employees that personal VPNs interfere with security monitoring.
- **Free Tools:** Use DNS-based filtering (like Cisco Umbrella or OpenDNS) to block categories associated with "Proxies and Anonymizers."
### For Medium Organizations
- **Identity Focus:** Enable Multi-Factor Authentication (MFA) with phishing-resistant methods (FIDO2) to counter the credential theft NordVPN users often face.
- **Automated Remediation:** Use RMM (Remote Monitoring and Management) scripts to automatically uninstall unauthorized VPN clients.
### For Large Enterprises
- **Conditional Access:** Implement strict policies that require devices to be "Compliant" or "Hybrid Azure AD Joined" before allowing access, effectively neutralizing personal VPN bypasses.
- **Data Center IP Blocking:** Actively block ingress traffic from ASNs associated with major consumer VPN exit nodes.
## Configuration Examples
* **Conditional Access (Conceptual):**
* *Condition:* Location = Any Location.
* *Exclude:* Trusted Corporate IP Ranges.
* *Client App:* Browser/Mobile/Desktop.
* *Grant:* Block Access IF the IP is identified as a "Proxy" or "Anonymizer" via threat intelligence feeds.
## Compliance Alignment
- **NIST SP 800-53:** AC-17 (Remote Access) and AC-19 (Access Control for Mobile Devices).
- **CIS Controls:** Control 2 (Inventory and Control of Software Assets) and Control 12 (Network Infrastructure Management).
- **ISO/IEC 27001:** A.13.1.1 (Network controls).
## Common Pitfalls to Avoid
- **Ignoring "Policy Violations":** Treating a legitimate employee using NordVPN as "low risk." Attackers often use the same encrypted tunnels to blend in with legitimate employee behavior.
- **Over-reliance on IP Whitelisting:** Assuming an IP is safe just because it originates from a domestic location; attackers use VPNs to "teleport" into your region.
- **Focusing Only on Perimeter:** Forgetting that identity is the new perimeter; a VPN only secures the tunnel, not the person using it.
## Resources
- **Huntress Managed ITDR:** [hXXps://www.huntress[.]com/platform/managed-itdr]
- **NIST Guide to Enterprise VPN Security:** [hXXps://csrc.nist[.]gov/publications/detail/sp/800-113/final]
- **MITRE ATT&CK - Proxy (T1090):** [hXXps://attack.mitre[.]org/techniques/T1090/]