🏳️‍🌈 Maril Vernon, CEH, MSCSIA

Lastly- let your red teams at it. I once worked at a big tech company who rolled out a fancy IDM + VPN solution combo and asked us (the red team) how easily we could bypass it if at all. We had 7 methods of bypass in a month and they went back to the drawing board. Test it all the way, not just for user experience.

Ahh the proof is in the pudding. Test the VPNs yourself- that's where the real intel is. Dive into those free trials or money-back offers. It's like taking a car for a spin – you gotta feel it out for your own needs. Not just with VPNs, but any solution. And vendors remember, reaching the stage of a demo or Proof-of-Concept often means you're among the final 2-3 contenders for selection, but don't stop there! Don't put all the effort forward while you're campaigning and forget to continue after you're elected.

A security professional will not hesitate to tell 100 people if they had a good or bad experience with a product or vendor. Fun fact, most of us don't go to trade shows or book demos when we have a product or solution need. We ask our friends, colleagues, or other people we know to use it for their experiences to determine if we want to use it ourselves. And over almost any feature or integration, the thing we care about most is after the sale. The implementation and continued support to make sure we're happy and the product is delivering on all of its promises. That or we'll off-board you so quickly it'll make your head spin. So make sure you check on those dark channels and market accordingly.

Defining 'user-friendly' in the context of VPNs is akin to setting stakeholder expectations in project delivery. Consider what aspects are most valued by end-users. Is it the lightness of the VPN in execution, minimal memory usage, the necessity for an agent-based system, or the frequency of required logins? A user-friendly VPN might be judged on ease of installation, configuration, operation, and maintenance. Other factors include performance, reliability, policy transparency, and responsive customer support. Identifying which of these aspects aligns with your users' needs ensures that the selected VPN will be successfully implemented and widely adopted.

Effective testing should not be an afterthought; it's a critical part of the security posture. You don't want a breach to be the first real test of your incident response plan. Similarly, critical systems, including those used by top executives like the CEO, should not be off-limits for testing. Often, there's a hesitation to test high-impact systems, but if these areas are potential targets in a breach, they must be included in regular testing. Empower red teamers to test all people, processes, and technology. If it's a potential target for attackers, it should be within the scope of your security testing. Allowing comprehensive testing across all systems ensures vulnerabilities are found and fixed before they're exploited.

If a breach occurs under your watch, use it as a means to discern what worked well and performed as intended and what needs to be remediated further. Breaches can happen to anyone at anytime. The key is to learn from each incident, ensuring the same attack path doesn't succeed twice. Conduct root cause analyses and lessons learned reviews to pinpoint weaknesses, then implement and measure the effectiveness of corrective actions. This approach, as seen in the Equifax breach, emphasizes the need for a continuous monitoring and improvement mindset in cybersecurity.