Remote access is where many of the most damaging breaches begin. A VPN account without MFA, a dormant login nobody disabled, a remote access appliance with an unpatched flaw or a help desk tricked into resetting credentials has opened the door to ransomware at pipelines, hospitals and technology companies. Traditional VPNs also grant broad network access once a user is in, so one compromised identity can reach far more than it needs. This guide covers the identity controls every remote access path needs, the shift from network-level VPN to per-application zero trust network access (ZTNA), and how to handle devices, third parties and the appliances themselves.
Key takeaways
- Every remote entry point needs phishing-resistant MFA, with no exceptions for legacy accounts, service accounts or "temporary" access.
- Dormant accounts on remote access systems are a standing invitation. Remove them automatically.
- ZTNA grants access per application based on identity and device, instead of putting users on the network.
- Remote access appliances are identity infrastructure: they hold credentials and sessions, so patch and monitor them accordingly.
- Third-party remote access needs its own brokered, time-limited path.
Lessons from incidents
- Colonial Pipeline (2021): an unused VPN account with a leaked password and no MFA.
- Change Healthcare (2024): a remote access portal without MFA.
- Cisco (2022): VPN access through a synced password, vishing and MFA fatigue.
- CitrixBleed (2023): an appliance flaw leaked session tokens that bypassed MFA.
- Ivanti Connect Secure (2024): VPN zero-days exposed user passwords and service account credentials stored on appliances.
Identity controls for every remote access path
- Integrate with the identity provider so remote access uses single sign-on and central policy, not local appliance accounts.
- Enforce phishing-resistant MFA for all users. See the MFA Guide.
- Remove local and legacy accounts on appliances, and protect any that must remain as break-glass accounts.
- Disable dormant accounts automatically after a defined period of inactivity, and on leaver events. See the Joiner-Mover-Leaver Guide.
- Limit session lifetime and re-evaluate sessions when risk changes. See the Token and Session Security Guide.
- Log and monitor sign-ins, including impossible travel, new devices and connections from hosting providers.
From VPN to ZTNA
| Traditional VPN | Zero trust network access | |
|---|---|---|
| What the user gets | A connection to the network, then reaches applications | A connection to specific applications only |
| Decision | Mostly at connection time | Per application and per session, using identity, device and context |
| Exposure | Appliance listening on the internet; broad lateral reach after login | Applications hidden behind a broker; limited lateral reach |
| Third parties | Often given full VPN profiles | Given access to named applications only |
ZTNA is often delivered as part of a secure access service edge (SASE) platform. Migration is usually phased: start with third parties and high-risk applications, then move general users, and keep a minimal VPN for use cases that genuinely need network-level access. See the Zero Trust Identity Guide.
Device posture
- Allow full access only from managed devices with a device identity and healthy posture.
- Give unmanaged and personal devices browser-based access to limited applications, or none.
- Remember that infostealers on personal devices harvest remote access credentials and cookies. See the Device and IoT Identity Guide.
Remote access for privileged users and third parties
- Route administrative remote access through PAM with just-in-time elevation and session recording. See the Privileged Access Management Guide.
- Give vendors and contractors named accounts, sponsor approval, time windows and access to specific systems only. See the Third-Party Access Guide.
- For OT and industrial systems, see the OT and ICS Identity and Access Guide.
Protecting the appliances
- Patch remote access appliances as an emergency priority; they are among the most exploited systems on the internet.
- Do not store more credentials on the appliance than necessary, and avoid highly privileged service accounts for directory lookups.
- After a known exploit, assume stored credentials, keys and sessions are compromised: rotate them and revoke sessions, not just patch. See the Leaked Credential Response Playbook.
- Monitor appliance integrity and management interfaces, and restrict management access.
Remote access and non-human identities
Scripts, backup tools and monitoring systems often use remote access paths too, typically through service accounts excluded from MFA. Replace them with workload identity or tightly scoped, source-restricted credentials, and keep them off the VPN used by people where possible. See the Service Account Security Guide.
Practitioner checklist
- Inventory every remote access path: VPNs, portals, remote desktop gateways, vendor tools and cloud consoles.
- Integrate each with the identity provider and enforce phishing-resistant MFA.
- Remove local, legacy and dormant accounts automatically.
- Move third parties and high-risk applications to ZTNA first.
- Use device identity and posture in access decisions.
- Broker privileged and vendor access with approval, time limits and recording.
- Patch appliances urgently and rotate stored credentials after any exploitation.
- Monitor remote sign-ins and sessions for anomalies.
Standards and references
- NSA and CISA: Selecting and Hardening Remote Access VPN Solutions (2021)
- NIST SP 800-46 Rev. 2: Guide to Enterprise Telework, Remote Access and BYOD Security
- NIST SP 800-207: Zero Trust Architecture
- CISA Zero Trust Maturity Model, version 2.0
Related NHI Mgmt Group resources: Zero Trust Identity Guide · MFA Guide · Privileged Session Management Guide · Third-Party Access Guide
