Ivanti Connect Secure Hardening and Integrity Checking

Ivanti Connect Secure has been exploited as a zero-day repeatedly since 2019, and in each wave attackers went after the same prize: the credentials, sessions, certificates and directory access that pass through the appliance. The CISA Known Exploited Vulnerabilities catalogue lists 14 entries for Connect Secure and its predecessor Pulse Connect Secure, the latest added on 13 October 2026. Hardening this product is therefore less about one-off configuration and more about three disciplines: fast patching on the right code line, integrity checking that you understand the limits of, and credential recovery that assumes everything the appliance held is exposed. This guide covers how authentication works on Connect Secure, administrator access, the machine identities the appliance stores, logging, the Integrity Checker Tool (ICT) workflow and a hardening baseline. It is for network, identity and incident response teams who run Connect Secure. General VPN appliance strategy, including alternatives, is covered in the VPN Security Guide.

Key takeaways

Patch on the vendor's timeline, not yours. CISA's ED 24-01 told US federal agencies to apply future Ivanti updates within 48 hours; CVE-2025-22457 was fixed in February 2025 but exploited from mid-March, after attackers studied the patch.
The ICT is necessary but not sufficient. It compares files with a signed manifest at a point in time; Mandiant saw attackers re-sign that manifest and fake upgrades, and Ivanti says it is not a malware scanner.
Run both external and internal ICT, and forward logs off the box. Attackers cleared local logs, edited the SELinux audit log and blocked syslog forwarding during exploitation.
A compromised appliance means a credential incident. Rotate certificates, the admin enable password, stored API keys, local and authentication server service accounts, and treat domain accounts used by the appliance as compromised.
Rebuild rather than clean. Factory reset hardware or deploy a fresh build for virtual appliances, upgrade, then reimport a reviewed configuration.

How identity and access work in Ivanti Connect Secure

Connect Secure uses an access management framework built on realms, roles and resource policies. A realm defines how a user signs in: the authentication server, an optional directory or attribute server, an authentication policy (conditions checked before credentials are even sent, including Host Checker restrictions), and role mapping rules. Users and administrators have separate realms, under Users > User Realms and Administrators > Admin Realms.

Component	Options	Hardening point
Authentication server	LDAP, Active Directory, RADIUS, certificate server, SAML, local	Prefer SAML to an IdP with phishing-resistant MFA, or certificate plus MFA; every directory server adds a bind service account to protect
Secondary authentication	Additional server for two-factor access; "End session if authentication against this server fails"	Make the second factor mandatory; avoid static secondary passwords
Fallback authentication (user realms only)	TOTP if the primary method fails	Treat as an exception path; monitor its use
Role mapping	Username, LDAP or RADIUS attribute, certificate attribute, group membership, custom expressions (including `geolocationCountry`)	Order matters; use "Stop processing rules when this rule matches" to avoid unintended merged roles
Dynamic policy evaluation	Refresh interval 5 to 1440 minutes	Shorter intervals remove access sooner after group changes
Host Checker	Endpoint posture checks tied to the authentication policy	Useful signal, not a security boundary on unmanaged devices

Ivanti recommends multi-factor authentication for all realms, and the admin console marks realms without MFA in red with an asterisk. Because a successful exploit sits in front of authentication, MFA does not stop appliance compromise; what it does is limit the value of passwords captured from the login page. In 2024 attackers inserted a credential harvester into the login page and later hijacked sessions to get past MFA, as described in the Ivanti Connect Secure Exploitation 2024. Short session lifetimes and re-authentication for sensitive resources reduce the value of stolen sessions. See the Remote Access Identity Guide.

Admin roles and privileged access

Administrator access to Connect Secure is full control of a device that terminates remote access for the whole organisation. Configure it as a separate privileged path:

Dedicated admin realm: a separate admin realm with its own authentication server and mandatory MFA, not the user realm with an admin role mapped on top. Keep one local break-glass administrator with a vaulted password and monitor its use.
Delegated admin roles: use read-only and scoped administrator roles for helpdesk and monitoring staff, and keep full administrator roles to a handful of named people.
Restrict where admins connect from: do not expose the admin console on the external interface. Limit administrative sign-in to the internal or management interface and to a management subnet or privileged access workstations, using the realm's authentication policy (source IP restrictions) as a second layer.
Admin enable password and console access: ED 24-01 recovery required resetting the admin enable password, which shows it is a credential attackers can use. Rotate it on a schedule and after any compromise.
REST API access: API keys used by automation can change configuration. Inventory them, scope them, and rotate them; CISA's recovery steps explicitly included resetting stored API keys.
Change control: Admin Access logs record administrator changes. Review them against approved changes weekly, and alert on new administrators or role changes.

See the Privileged Access Management Guide for vaulting and session controls.

Integrations, API tokens and service accounts

A Connect Secure appliance is a dense store of non-human credentials. Mandiant saw attackers archive the appliance's database cache, which can contain session data, API keys, certificates and credential material, and stage it for download disguised as a CSS file. The 2024 campaign patched a binary to dump configuration without redacting sensitive fields. Build an inventory of everything below, with owner and rotation procedure, before you need it.

Credential on the appliance	Typical use	Rotation after compromise	Design advice
LDAP or AD bind account	User lookup and group membership for role mapping	Reset (ED 24-01: assume domain accounts tied to the product are compromised; reset twice)	Read-only, not privileged, monitored for use from anywhere but the appliance
AD machine or domain join account	Active Directory authentication server	Reset; revoke Kerberos tickets	Minimum rights; never a domain administrator
RADIUS shared secrets	MFA or RADIUS authentication servers	Replace on both sides	Unique per appliance
SAML signing and encryption certificates	Federation with the IdP	Revoke and reissue, update IdP metadata	Monitor IdP for sign-ins asserted by the appliance's service provider identity
Device TLS certificate and private key	The public VPN endpoint	Revoke and reissue	Track expiry and issuance in certificate inventory
Client and machine certificates trusted by the appliance	Certificate authentication, machine authentication	Review trusted CAs; revoke issued certificates if keys were exposed	Anomaly detection on client certificates (Mandiant recommendation for CVE-2025-22457)
Local user accounts	Break-glass, contractors	Reset all	Minimise; prefer the IdP
REST API keys	Automation and configuration management	Reset	One key per integration
SSO and resource credentials (secondary passwords, bookmarks with stored credentials)	Web, file and terminal resources	Reset any static values	Avoid static credentials in resource policies
Cloud tokens in hybrid deployments	Entra ID or other cloud-joined devices and users	Revoke tokens; disable affected cloud devices	Conditional access that does not trust the VPN address alone

The live breach page above shows the consequence of skipping this step: attackers used credentials captured on the appliance to dump LSASS and extract the Active Directory database. See the Secrets Rotation Runbook Template and the Edge Device Security Guide.

Logging and detection

The appliance keeps Event logs (system events, errors, restarts), User Access logs (sign-ins, sign-outs, concurrent users), Admin Access logs (configuration changes) and client-side logs such as Host Checker. All can be sent to syslog servers and SNMP. Because attackers have tampered with on-box logs and blocked syslog forwarding, the off-box copy is the only one to rely on.

Signal	Source	What it can indicate	ATT&CK
Requests to version-check paths such as `/dana-cached/hc/hc_launcher.` from VPS providers or Tor	Web logs, WAF or upstream proxy	Version fingerprinting before exploitation (CERT-EU, CVE-2025-0282)	T1190 Exploit Public-Facing Application
Gaps in syslog delivery, sudden drop in event volume	SIEM health monitoring	Log forwarding blocked or logs cleared	T1070 Indicator Removal, T1685 Disable or Modify Tools
Web process crashes and core dumps	Event logs, ICT statedump	Memory corruption exploitation (Mandiant, CVE-2025-22457)	T1190
ICT reports new or modified files; upgrade reports success but version or behaviour unchanged	External and internal ICT	Implants, fake upgrades (PHASEJAM)	T1601.001 Patch System Image, T1505.003 Web Shell
Bind account or appliance accounts used from hosts other than the appliance; LSASS or NTDS access	Domain controller and EDR logs	Stolen appliance credentials used internally	T1078 Valid Accounts, T1003.003 NTDS
Same user session from two source addresses; sign-ins with no corresponding MFA event	User Access logs, IdP logs	Session hijacking or harvested passwords	T1539 Steal Web Session Cookie, T1056.003 Web Portal Capture
Changes to the authentication module or new admin objects	Admin Access logs, ICT	Credential capture (DRYHOOK modified `DSAuth.pm`)	T1556 Modify Authentication Process

Metrics to track:

Time to patch: hours from an Ivanti security advisory to all appliances updated (benchmark: 48 hours, the ED 24-01 standard).
ICT cadence: percentage of appliances with an external ICT run in the last 30 days and after every upgrade, with results reviewed.
Log continuity: maximum gap in syslog events per appliance per week (alert above a threshold that suits your volume).
Credential inventory coverage: percentage of appliance-held credentials with a named owner and a tested rotation procedure.
Supported code line: appliances on a supported release (9.x reached end of life on 31 December 2024).

Investigation steps for a suspected compromise are in the Edge Device Compromise Investigation Playbook.

Hardening baseline

Integrity checking: how to use the ICT properly

Run both tools: the internal ICT runs on the appliance; the external ICT is Ivanti's separate tool that takes a point-in-time snapshot and flags changed or added files. Since the enhanced external ICT of February 2024, customers receive unencrypted snapshots to review when new or modified files are found.
Schedule it: run the external ICT after every upgrade, after any advisory, and on a regular cadence. ED 24-01 noted that running it reboots the appliance, so plan a window.
Interpret results with context: a clean result does not rule out compromise. Mandiant observed attackers recalculating hashes, updating and re-signing the manifest, and running in-memory-only droppers that leave nothing on disk.
Combine with other evidence: off-box logs, core dump monitoring, network detection on traffic from the appliance, and identity telemetry on accounts the appliance uses.
Escalate on any finding: preserve forensic images, contact Ivanti Support and start the recovery process below.

Configuration baseline

Stay on a supported code line and the latest fixed release for it (for CVE-2026-104935: 22.8R2.5, 25.1.1.2 or 25.1.3.x, according to Rapid7's summary of Ivanti's advisory).
Admin console only on the internal or management interface; source IP restriction on admin realms; MFA on every realm.
Remove unused realms, roles, sign-in URLs, authentication servers and resource policies; disable features you do not use.
Do not expose Policy Secure or other components that are not meant to face the internet (CERT-EU).
Syslog to at least one collector over a reliable transport, with health alerting.
Limit what the appliance can reach: resource policies to named internal applications, and network controls so the appliance's own address cannot reach domain controllers beyond the ports authentication needs.
Session timeouts and maximum session lengths that match risk; re-authentication for sensitive applications.
Configuration exports stored securely: they contain sensitive values.

Recovery when compromise is suspected

Isolate the appliance from enterprise resources and preserve forensic images.
Export the configuration and review it for attacker changes before reuse.
Factory reset hardware appliances; for virtual appliances, Ivanti advises deploying a new build because resets have not been consistently successful.
Upgrade to a fixed, supported release, reimport the reviewed configuration and remove any temporary mitigation XML.
Rotate every credential in the table above; reset domain accounts tied to the appliance twice, revoke Kerberos tickets and cloud tokens.
Hunt beyond the appliance: domain controllers, jump hosts and systems reached through the VPN.

Decision guidance

Hardware or virtual: virtual appliances are easier to replace with a clean build, which is now Ivanti's preferred recovery route for them; hardware needs a reliable factory reset and possibly a refresh if it cannot run a supported release.
Keep, segment or replace: if you cannot meet a 48-hour patch window and staff ICT and log review, consider reducing the appliance's role (fewer resources, no directory bind with broad rights) or migrating to an alternative remote access model. The Secure Remote Access Beyond VPN Guide compares options.
Small organisations: a managed service or SaaS access broker removes appliance patching from the team's workload; large estates need automated version inventory, staged upgrades and a pre-written credential rotation runbook.

Common misconfigurations

Patching without checking for prior compromise: PHASEJAM blocked real upgrades while showing a convincing progress bar, and SPAWNANT copied implants into the upgrade partition. Verify version and run the external ICT after every upgrade.
Trusting a single clean ICT result: treated as an all-clear, it missed in-memory implants and tampered manifests.
On-box logs only: attackers cleared kernel messages, debug and application logs and blocked syslog during exploitation.
Privileged directory bind accounts: a bind account with more than read access turns appliance compromise into domain compromise.
Running end-of-life 9.x: 9.x stopped receiving fixes on 31 December 2024; CVE-2025-0283 and CVE-2025-22457 affected it with no patch.
Rotating some credentials, not all: leaving SAML certificates, API keys or the admin enable password unchanged after recovery leaves a path back in.

Framework mapping

Control	NIST SP 800-53 Rev. 5	NIST CSF 2.0	CIS Controls v8.1	D3FEND / ATT&CK
48-hour patching, supported code line	SI-2, SA-22	ID.RA-01, PR.PS-02	7.7 Remediate detected vulnerabilities	T1190
External and internal ICT	SI-7 Software, Firmware, and Information Integrity	DE.CM-09	4.1 Secure configuration process	D3-FIM File Integrity Monitoring; T1601.001
Admin realm MFA, source restriction	IA-2, AC-6, AC-17	PR.AA-03, PR.AA-05	6.5 MFA for administrative access	T1078
Appliance credential inventory and rotation	IA-5	PR.AA-01	5.6 Centralise account management	T1556, T1003.003
Off-box logging with gap alerting	AU-2, AU-9, SI-4	PR.PS-04, DE.CM-01	8.9 Centralise audit logs	T1070, T1685
Rebuild and recovery	IR-4	RS.MI-01	17.4 Incident response process	Not applicable

Practitioner checklist

List every Connect Secure, Policy Secure and ZTA gateway with code line, version, form factor and exposure.
Subscribe to Ivanti advisories and the KEV catalogue; patch within 48 hours and verify the running version afterwards.
Run the external ICT after every upgrade and monthly; review snapshots; never treat one clean run as proof.
Forward Event, User Access and Admin Access logs off-box and alert on gaps.
Admin console on the internal or management interface only, separate admin realm, MFA everywhere.
Inventory every credential the appliance holds, with owner and rotation steps, and test rotation once a year.
Make directory bind accounts read-only and alert on their use from anywhere but the appliance.
Prepare the recovery runbook: isolate, image, reset or rebuild, upgrade, reimport, rotate, hunt.
Retire end-of-life code lines and hardware.

Ivanti Connect Secure Hardening and Integrity Checking Guide: Patching, ICT and Recovery