CERT-In asks organisations to guard VPNs against cyber attacks

Federal cyber agency CERT-In on Tuesday warned of increased cyber attacks, including 'social engineering hits', on Virtual Private Network (VPN) being used by organizations these days to facilitate work from home for its employees given the nationwide lockdown to combat the COVID-19 outbreak. In a fresh advisory, the Computer Emergency Response Team of India (CERT-In) advised against social engineering attacks where cheats pose as genuine back-end support and obtain sensitive data from gullible employees.

These trends have emerged due to the increase in online activity during the ongoing lockdown to contain the spread of COVID-19. "The coronavirus pandemic has led many organizations worldwide to restrict their employees from coming to work in an office and have advised them to maintain social distancing and to continue working from the safe environment of their homes.

"Organisations are using enterprise VPNs for communicating through emails, video conferencing and other chat tools. A VPN enables communication through secure online servers using encryption of data," the CERT-In said. With a large number of organizations using VPN for business continuity, it said, attackers, are finding vulnerabilities to target organizations for various cyber attacks. "Therefore, organizations should set up a system in coordination with their information technology staff to secure the VPN service to maintain business confidentiality, integrity, and availability," the CERT-In, a federal agency to combat cyberattacks to guard the Indian cyberspace, said.

It also suggested that the organizations should sensitize their employees against increased phishing attempts where cybercriminals send emails or text messages posing as genuine people and take sensitive information. "Pandemics like COVID-19 could lead to social engineering attacks. Employees need to be alerted about such attacks, wherein fraudsters could pose as a genuine organization and send emails to obtain sensitive personal or organization-level information," it said.

It also suggested some counter-measures and best practices for using VPNs, which included increased scrutiny of unauthorized activity using log analysis, detect attacks promptly and respond to incidents. They should also check their systems for Distributed Denial of Services (DDoS) attacks on VPN servers. In this, a cybercriminal blocks the service of the online system to the intended use by triggering malicious activity.

"An attacker could conduct various DDoS attacks leading to the crashing of the VPN server. Such attacks could also limit or cut-off system administrators from the servers leading to further compromise of the internal attack," it said. It recommended multi-factor authentication (MFA) for using VPN accounts to "avoid any unauthorized activity during work from home, organizations should enable an MFA solution on all VPN accounts leading to better data security". "Incase, MFA cannot be implemented, employees should be advised to use strong passwords to block any account takeover attacks," it said.

The agency reiterated that "latest software patches" should be used and advanced security configurations deployed to keep the VPN safe. It also advised that all the IT teams of various organizations should test the VPN server for mass usage and encourage "rate-limiting so that priority is given to users who require higher bandwidth".