Skip to main content

New VPN Connection

This alert occurs when Lacework detects the creation of a new VPN connection.

Why this Alert is Important

VPN connections are often used to add a layer of security to the business environment. A new VPN connection, however, could often indicate malicious behavior because an unauthorized VPN connection provides access to the company’s internal environment to an outsider.

Investigation

Check which VPN connections in the company are authorized. Also, check who initiated the VPN connection and find out the destination in case of an unauthorized VPN connection.

Resolution

Ensure that only authorized users and VPN connections are allowed in the company network.

https://attack.mitre.org/techniques/T1078/