Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise’s AAA Infrastructure
Description
Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices.
Implementation Checklist
Tool Recommendations
AI-driven network detection and response with self-learning threat analysis and autonomous response
Darktrace · Enterprise subscription
AI-driven threat detection and response for network, cloud, and identity with attack signal intelligence
Vectra AI · Enterprise subscription
Network detection and response platform with real-time traffic analysis, encrypted traffic inspection, and cloud visibility
ExtraHop · Per-device/bandwidth subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Remote Device Compromise Spreading to Enterprise Network
ConfidentialityRemote devices compromised by malware while connected to untrusted networks (hotels, coffee shops, home networks) connect directly to enterprise resources without VPN tunnel protection, introducing the compromise into the corporate environment.
Credential Interception on Untrusted Networks
ConfidentialityRemote users authenticate to enterprise services over untrusted networks without VPN encryption, allowing man-in-the-middle attackers to intercept credentials, session tokens, and sensitive data transmitted in transit.
Split Tunnel Bypass of Enterprise Security Controls
IntegrityRemote devices without VPN requirements access both internet resources and enterprise resources simultaneously, allowing malware or attackers to pivot from the untrusted internet side to the enterprise network through the unprotected device.
Vulnerabilities (When Safeguard Absent)
No VPN Requirement for Remote Enterprise Access
Remote users access enterprise resources directly over the internet without being required to establish a VPN connection first, transmitting potentially sensitive data over untrusted network paths without tunnel encryption.
Remote Devices Not Authenticating to Enterprise AAA Infrastructure
Remote end-user devices connect to enterprise resources without authenticating through the organization's centralized AAA infrastructure, bypassing conditional access policies, MFA requirements, and device compliance checks.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |