New VPN Connection
This alert occurs when Lacework detects the creation of a new VPN connection.
Why this Alert is Important
VPN connections are often used to add a layer of security to the business environment. A new VPN connection, however, could often indicate malicious behavior because an unauthorized VPN connection provides access to the company’s internal environment to an outsider.
Investigation
Check which VPN connections in the company are authorized. Also, check who initiated the VPN connection and find out the destination in case of an unauthorized VPN connection.
Resolution
Ensure that only authorized users and VPN connections are allowed in the company network.