Skip to main content

Pro audit program · v1.0

VPN Configuration Audit

Audit your VPN: who can connect, with what, from where, and what they can reach.

  • General target area
  • NIST CSF framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Audit your VPN: who can connect, with what, from where, and what they can reach.

Risks addressed

  • Critical Compromised credential gives full intranet access
  • Medium Split-tunnel leaks internal traffic outbound
  • High No device posture check before VPN access

Controls (6)

  1. MFA enforced on VPN logins

    Critical

    This control requires that all users connecting to the organization's Virtual Private Network (VPN) infrastructure must successfully authenticate using multi-factor authentication (MFA) before gaining access to internal resources. MFA enforcement typically involves combining something the user knows (password) with something…

    How to test + evidence

    Testing procedure: Verify VPN auth flow enforces MFA via IdP or RADIUS-MFA.

    Evidence to collect: VPN auth config + auth logs sample.

  2. Device posture check before access

    High

    Device posture check before access ensures that endpoints attempting to connect to enterprise resources meet predefined security criteria before network or application access is granted. The control typically evaluates device characteristics such as operating system patch level, presence and currency…

    How to test + evidence

    Testing procedure: Endpoint must be company-managed (cert / agent) before VPN tunnel opens.

    Evidence to collect: Posture-check policy.

  3. Network access limited to need-to-know subnets

    High

    This control enforces network segmentation such that systems and users can only access network subnets required for their authorized functions, preventing lateral movement and limiting the blast radius of compromised credentials or systems. Implementation typically involves VLAN segregation, firewall rulesets,…

    How to test + evidence

    Testing procedure: VPN clients restricted by group → subnet ACLs, not flat access.

    Evidence to collect: ACL export by group.

  4. Modern crypto only (no PPTP / L2TP)

    High

    This control mandates the exclusive use of cryptographically strong VPN protocols (such as IKEv2/IPsec, OpenVPN, or WireGuard) and explicitly prohibits legacy protocols PPTP (Point-to-Point Tunneling Protocol) and L2TP (Layer 2 Tunneling Protocol) without IPsec. PPTP uses weak MPPE encryption vulnerable…

    How to test + evidence

    Testing procedure: TLS 1.2+ / IPsec IKEv2; old protocols disabled.

    Evidence to collect: VPN config.

  5. VPN logs streamed to SIEM

    Medium

    This control ensures that all authentication, connection, and session logs generated by Virtual Private Network (VPN) infrastructure are forwarded in real-time or near-real-time to a centralized Security Information and Event Management (SIEM) platform. VPN logs include successful and failed login…

    How to test + evidence

    Testing procedure: All auth + session events sent to SIEM.

    Evidence to collect: SIEM source inventory.

  6. Idle timeout + reconnection requires reauth

    Medium

    This control enforces automatic session termination after a defined period of user inactivity and requires full reauthentication when a user attempts to resume or reconnect. Idle timeout thresholds are configured based on system sensitivity and compliance requirements, typically ranging from…

    How to test + evidence

    Testing procedure: Sessions disconnect after idle window; reconnect requires MFA again.

    Evidence to collect: VPN policy export.