Quick q for those with VPN access

[CyBeRkId2002]

I just wondered, for those who use VPN's for all staff to remote in, do you enforce MFA?

 

We have currently have a RDG with MFA enabled and with the increase in Ransomware, credential phishing and the like I think the MFA part is absolutely essential and certainly helps me sleep at night. I have the same thinking around VPNs but just wanted to quickly check what others are doing.

[Guest Guest]

We don't, authentication is via certificate though so better than password authentication

[Boredguy]

Likewise ours is also certificate based, and has to be a school device for the certificate to be available as it's only pushed out to devices via GPO.

[3s-gtech]

Yup, certs here.

[CyBeRkId2002]

Thanks for the responses so far. Hadn't considered certs to be honest. Is this in conjunction with a password, or replacement?

 

If the former I suppose this is a form of MFA.

 

Either way you're right, it is far better than just a password if the cert is well managed.

[Norphy]

I would imagine that most people are using some kind of transparent Always-On VPN which kind of precludes the use of a password. It uses a certificate for authentication instead of a password, whether that's a device tunnel or a user tunnel. I certainly did when I was working in edu. I implemented it just before lockdown and I'm very glad I did.

 

My current workplace uses a Cisco ASA device for its VPN which piggybacks onto Azure MFA, so whenever I need to use it I get the usual authentication prompt on my phone to get in.

[MatthewL]

Mixture of both DirectAccess & Always on VPN (migration in progress), computer based tunnel, domain joined devices, all they need is an internet connection weather wired or wifi at home or tethered same experience away from the office where ever they are working, usual AD credentials, all laptops request bitlocker pin on startup, over 80% of our users are mobile workers anyway.