When a U.S. Senator calls for the removal of an entire category of infrastructure, you should pay attention. Sen. Ron Wyden's proposal to give federal agencies two years to remove legacy remote access gateways isn't political theater. It's recognition that edge devices have become the preferred entry point for nation-state actors, and the endless cycle of patching vulnerable VPNs and firewalls isn't working.
If you're responsible for federal system security or work with agencies as a contractor, this timeline matters. Here's how to execute the transition before you're forced to explain why your agency missed the deadline.
The Problem: Why Edge Devices Keep Getting Compromised
Legacy edge devices sit at the network perimeter, exposed to the internet, running firmware that's updated quarterly if you're lucky. They authenticate users, then grant broad network access. This architecture made sense when your workforce sat inside the building. It's a liability now.
The attacks Wyden cited (Arcane Door, FortiBleed, and compromises of Ivanti and Check Point devices) share a pattern: attackers exploit device vulnerabilities to gain administrative access, then pivot into the network. A March VulnCheck report found that roughly 42% of vulnerabilities exploited last year affected devices that are end of life or likely end of life. You can't patch hardware the vendor stopped supporting.
Zero Trust Architecture eliminates the concept of a trusted perimeter. Instead of authenticating once and roaming the network, users authenticate to specific resources. Instead of running public-facing VPN concentrators, you use outbound-only connections. The attack surface shrinks to individual application endpoints, not your entire network edge.
What You Need Before Starting
Don't start ripping out VPNs on Monday. You need:
Asset inventory: Document every edge device that terminates remote access. Include VPN concentrators, SSL VPN appliances, remote desktop gateways, and any device that authenticates external users and grants network access. Note the vendor, model, firmware version, and what it protects.
Application catalog: List every application remote users access. Include SaaS applications, on-premises web apps, SSH targets, RDP hosts, and file shares. For each, document authentication method, network location, and user population.
Identity provider: You'll need a centralized identity system that supports modern protocols (SAML 2.0, OpenID Connect). If you're still using LDAP as your only directory, you're not ready.
Network visibility: Deploy flow monitoring so you can see what users actually access. You'll discover applications you didn't know existed.
Executive sponsorship: This isn't a security project. It changes how every remote user works. Get written support from your CIO and budget authority for both capital expenses and temporary productivity loss.
Step-by-Step Implementation
Phase 1: Deploy the Zero Trust Access Layer (Months 1-3)
Select a zero trust network access platform. Options include commercial solutions (Zscaler Private Access, Cloudflare Access, Palo Alto Prisma Access) or open-source frameworks you can build on (like using WireGuard with per-application tunnels).
The key architectural requirement: connections must be outbound-only from your network. Install lightweight connectors inside your network that establish persistent outbound connections to the access platform. Users authenticate to the platform, which proxies their connection through the appropriate connector. No inbound firewall rules required.
Start with a pilot: Pick 50 users and five low-risk applications. Configure the access platform to require multi-factor authentication and verify device posture before granting access. Run this in parallel with existing VPN access for 30 days while you work out authentication issues and application compatibility.
Phase 2: Migrate Applications (Months 4-15)
Move applications in waves, starting with the easiest:
Wave 1: Web applications with modern authentication. These migrate cleanly because the access platform can inject identity headers or handle SAML assertions. Test thoroughly, then cut over users.
Wave 2: SSH and RDP access. Configure the platform to proxy these protocols. You'll need to retrain users (they'll connect to the platform URL, not directly to the server). Document the new workflow with screenshots.
Wave 3: Legacy applications with embedded authentication. These require application-level changes or acceptance of reduced security (like allowing password authentication). Be prepared to tell application owners you can't support their 15-year-old Java app without modifications.
For each wave, establish a two-week testing window with a subset of users, then a one-week cutover window where you disable VPN access for those applications and force users to the new platform.
Phase 3: Decommission Edge Devices (Months 16-20)
Once all applications are accessible through the zero trust platform, schedule VPN shutdown. Give users 30 days' notice. On the cutoff date, disable authentication on the VPN but leave the device running in monitoring mode for two weeks. Watch for connection attempts (you'll find forgotten applications).
After the monitoring period, power down the device. Leave it offline for 30 days before decommissioning, in case you need to temporarily restore access.
Document the decommissioning in your system security plan and update your NIST SP 800-53 control implementations. You've just eliminated an entire class of AC-17 (Remote Access) risks.
Phase 4: Implement Enhanced Protections (Months 18-24)
With legacy devices gone, add the safeguards Wyden proposed:
Memory-safe code: Audit your remaining infrastructure components. Where you control the codebase, migrate from C/C++ to Rust or Go for network-facing services. Where you don't, pressure vendors for roadmaps.
Decentralized encryption: If you're using a zero trust platform that holds your encryption keys, you're trading one centralized risk for another. Implement per-application encryption with keys managed by each application owner, not the access platform provider.
Validation: How to Verify It Works
Run these checks monthly:
External scan: Use a vulnerability scanner from outside your network. You should see no VPN login portals, no SSL VPN endpoints, no exposed remote desktop gateways. If the scanner finds an authentication page, you missed something.
Access log review: Pull authentication logs from your zero trust platform. Every access attempt should show multi-factor authentication and device posture verification. If you see password-only authentications, investigate.
User access testing: Randomly select 10 users each month. Verify they can access their required applications and cannot access applications outside their role. Test from both managed and unmanaged devices.
Connector health: Monitor your outbound connectors. If a connector goes offline, users lose access to those applications. Set up alerts for connector failures with a 5-minute SLA.
Maintenance and Ongoing Tasks
Quarterly application reviews: Your application inventory will drift. New apps get deployed, old ones get forgotten but not decommissioned. Review access logs quarterly to find applications with zero usage in 90 days.
Annual architecture review: Zero trust platforms evolve. Review your vendor's roadmap annually. Are they adding features that would improve your security posture? Are they deprecating features you depend on?
Continuous monitoring: Feed access logs into your SIEM. Alert on authentication failures, impossible travel (user authenticates from New York, then Tokyo 10 minutes later), and access to sensitive applications outside business hours.
Vendor risk assessments: Your zero trust platform is now critical infrastructure. Conduct annual vendor risk assessments. What's their incident response plan? Where do they store logs? Do they have SOC 2 Type II reports you can review?
The two-year timeline Wyden proposed is tight but achievable if you start now. The alternative is explaining to CISA why your agency is still running the same VPN architecture that's been compromised in every major breach for the past three years.
