If your staff connect to the office from home, there is a good chance your business has a firewall or VPN facing the internet. That box is the front door to your network, and this week security researchers published details of a large campaign aimed squarely at it.
What has been reported
According to The Hacker News, researchers have disclosed a large-scale campaign targeting exposed network “edge” devices, naming Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls as examples. The report says more than 70,000 sets of login details were exposed, and that the people behind it obtained access to numerous organisations worldwide and attempted to go further inside some of them.
FortiGate in particular is very common in Australian small and medium businesses, often installed years ago and rarely looked at since.
Why it matters to a small business
A firewall or VPN is trusted by design. If someone gets in through it, they can look like a normal remote worker. You do not need to be a big target to be caught up in a campaign like this, because attackers scan the whole internet for any device they can reach.
What to check this week
- Know what you have. Find out the make and model of your firewall or VPN, and who looks after it.
- Update the firmware. Ask your IT provider when it was last updated and whether it is still supported by the vendor.
- Turn on multi-factor authentication for VPN logins, so a stolen password alone is not enough.
- Change VPN passwords if they have not been changed in a long time, and remove accounts for former staff.
- Keep the admin page off the internet. The management screen should only be reachable from inside your office network.
- Check the logs for logins at odd hours or from overseas.
None of this needs new equipment. It is mostly the routine maintenance that slips when the internet “just works”.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.