What Happened
Senator Ron Wyden has urged CISA, OMB, and NIST to eliminate legacy VPN infrastructure from federal networks within two years. His letter highlighted multiple breaches involving VPN products from Cisco, Fortinet, Ivanti, and Check Point, where foreign adversaries gained administrative access and stole sensitive data. Wyden specifically called for civilian agencies to replace public-facing remote access systems with Zero Trust Architecture, and for the NSA to implement a similar purge across military and intelligence networks.
Timeline
While specific breach dates aren't provided, the pattern is clear: legacy VPN vulnerabilities have been repeatedly exploited. Wyden's letter is a policy response to "multiple recent and devastating hacking campaigns" compromising both federal agencies and government contractors. The proposed two-year deadline for civilian agencies sets a concrete timeline for remediation, though no similar deadline was specified for defense and intelligence systems.
Which Controls Failed or Were Missing
The failures here aren't about missing patches or misconfigured firewalls. They're architectural. Legacy VPNs failed in three fundamental ways:
Perimeter-based trust model. These systems assume that once you're authenticated, you're trusted. An attacker who compromises VPN credentials or exploits a VPN appliance vulnerability gains the same level of access as a legitimate user. There's no continuous verification, no segmentation enforcement, and no assumption of compromise.
Public-facing attack surface. As Wyden noted, these entry points "broadcast their presence." Attackers can scan the internet, identify vulnerable VPN appliances, and target known CVEs. The attack surface is fixed, discoverable, and often running software that can't be patched quickly due to operational constraints or vendor delays.
Administrative access pathways. Once inside through a compromised VPN, attackers gained administrative access to target networks. This suggests inadequate network segmentation and overly permissive access policies. A user connecting remotely shouldn't automatically have administrative privileges or lateral movement capability.
The missing control is continuous verification of identity and context. Legacy VPNs authenticate once at the perimeter, then trust everything inside. That model fails when the perimeter itself is compromised.
What the Relevant Standards Require
NIST SP 800-207 defines Zero Trust Architecture around the principle that no user or device is inherently trusted, regardless of location. The standard requires:
- Continuous authentication and authorization for every access request
- Micro-segmentation to limit lateral movement
- Principle of Least Privilege enforcement
- Monitoring and logging of all access attempts
NIST SP 800-53 Control AC-2 (Account Management) requires organizations to implement automated mechanisms for disabling accounts and removing access. Control AC-6 (Least Privilege) mandates that users operate with the minimum privileges necessary. Neither control is effectively implemented when a compromised VPN credential provides broad network access.
NIST Cybersecurity Framework (CSF) 2.0 emphasizes that access control policies must be established, communicated, and enforced. The Protect function requires identity management and access control mechanisms that limit access to assets. A VPN that grants administrative access after a single authentication event violates both principles.
CISA's Zero Trust Maturity Model explicitly calls for moving from perimeter-based security to identity-centric security. The model defines five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Legacy VPNs fail across all five because they don't verify device posture, don't enforce application-level policies, and don't implement data-level access controls.
Lessons and Action Items for Your Team
Map your current remote access architecture against Zero Trust Architecture principles. Document every public-facing remote access system. For each one, answer: Does it verify user identity continuously? Does it check device health before granting access? Does it enforce least privilege at the application level? If the answer to any of these is no, you're running the same risk profile that prompted Wyden's letter.
Implement phased Zero Trust Architecture adoption, starting with your highest-risk access paths. You don't need to replace everything in 90 days, but you do need a sequenced plan. Start with administrative access to critical systems. Replace VPN-based admin access with Just-in-Time Access mechanisms that grant temporary, scoped credentials based on verified need. Document this plan in a way that satisfies NIST SP 800-53 Control PL-2 (System Security Plan).
Separate authentication from authorization. Your identity provider should verify who someone is. Your policy engine should decide what they can access based on identity, device posture, location, and requested resource. These should be separate components with separate logging. If your VPN handles both, you're conflating concerns that should remain distinct.
Enforce device trust verification before granting access. This means checking for current patches, running endpoint protection, and compliant configuration before allowing a device to connect. NIST SP 800-207 Section 3.2 describes this as "device authentication and authorization." If you're not inspecting device state before granting access, you're trusting endpoints you shouldn't trust.
Eliminate standing administrative access for remote users. No one should have permanent admin rights accessible via remote access. Implement Just-in-Time Access with time-limited privilege elevation. Log every elevation request and every action taken with elevated privileges. This satisfies NIST SP 800-53 Control AC-6(2) (Non-Privileged Access for Nonsecurity Functions) and makes forensic investigation possible when something goes wrong.
Assume your perimeter is already compromised and design accordingly. This is the core Zero Trust Architecture assumption. If an attacker has VPN credentials today, what can they access? If the answer is "everything," you need micro-segmentation. Segment by application, by data classification, by user role. Make lateral movement require re-authentication and re-authorization at every step.
Set your own deadline. Wyden proposed two years for civilian agencies. Don't wait for a mandate. If you're running public-facing VPN appliances from vendors that have been targeted in recent campaigns, you're in the blast radius. Set a six-month deadline to eliminate or significantly reduce your public-facing VPN attack surface, and a 12-month deadline to implement Zero Trust Architecture for administrative access.
The pattern here is clear: perimeter-based security fails when the perimeter itself becomes the target. Your remote access architecture should assume compromise, verify continuously, and enforce least privilege at every layer. That's not a future state; it's the current requirement.
