Security

4 Ways to Improve VPN Safety for Remote Healthcare Work

Critical to secure remote work, virtual private networks can be compromised. Here’s how to keep threat actors at bay.

Karen Scarfone is the principal consultant for Scarfone Cybersecurity. She previously worked as a senior computer scientist for the National Institute of Standards and Technology.

Many remote healthcare teams rely on virtual private networks to safely send and receive data. But the encryption service can be infiltrated by threat actors, as noted in a recent advisory from the Department of Homeland Security that predicts more VPN attacks are likely during the pandemic. Consider these tips to protect your VPN servers:

1. Deal with VPN Security Weaknesses Immediately

Any vulnerability in a VPN server’s operating system, services or other software could be used to attack other systems or to access and manipulate employees’ network communications. For software bugs, know when patches and updates are released; test and deploy them as quickly as possible. Continuously monitor security-related software configuration settings and alert your teams when a setting is altered without consent.

2. Limit VPN Direct Access to Approved Parties

Only authorized administrators should have direct access to VPN servers. Healthcare workers and other users don’t need it (their network traffic will flow through the VPN servers). To that end, only allow connections using secure protocols that encrypt all communications and require mutual authentication of the VPN server and the VPN administrator’s computer. Require multifactor authentication for all VPN administrators.

3. Practice Constant Security Vigilance with Servers

Because VPN servers are so important, especially now with increased use, it’s crucial to closely monitor the servers’ security at all times and to have incident handlers or other IT security personnel automatically contacted when suspicious activity is detected. This allows attacks to be identified and thwarted more quickly, thus reducing the amount of potential damage an attacker might cause.

4. Keep Watch for Subtle Threats to Your VPN

Beyond looking for obvious red flags, such as malware downloaded to a VPN server, keep watch for things that are more anomalous — a VPN server initiating connections to unknown IP addresses, for instance. Other risk factors may include unexpected protocols being used by a VPN server and unexplained administrator account lockouts. Any sign of compromise, however small, should be investigated immediately.

Employees’ Personal Networks Must Be Able to Handle the Work-From-Home Load

The office VPN may be ready to handle the load of all staff members working from home, but the employees’ own home networks might not be. Healthcare organizations have to take that limitation into consideration as well.

“Think of it as an extended branch office,” suggest Robert Herriage and Sven Rasmussen, who work on enterprise networking for CDW. Healthcare providers must make sure that their employees “have adequate bandwidth and performance on their home internet to support your organization’s productivity suite.”

Know the requirements for voice, video or other performance-heavy applications, especially the bandwidth needed to run them cleanly; this information can be found in the product data sheets.

Herriage and Rasmussen also point out in a CDW Solutions Blog post that home internet connections often have bandwidth restrictions. “You’ll need to consider how you want to handle those restrictions so they do not impact your users financially,” they write. “Will you reimburse overages? Will you supply a cellular hotspot for your users? … There is no right answer, but these things do need to be considered.”

Finally, help employees figure out how their own home internet connections perform. They may have to download a speed test on their devices and provide the data to the IT department, which can then determine which workers need the most help to get the best connection.

Read Herriage and Rasmussen’s full advice on the CDW Solutions Blog.

PeopleImages/Getty Images