Governance & Risk Management
,
Remote Workforce
Paper Traces Pandemic-Era Spike in Attacks
One way to look at the novel coronavirus pandemic: A societal experiment in how an oft-overlooked yet essential element of secure networking would stand up to an exploding user base. Unsurprisingly, the rapid uptake of virtual private networks by companies suddenly managing a remote workforce came with significant security costs.
Researchers from the Blekinge Institute of Technology in Sweden in a 2025 paper counted a 238% surge in VPN targeted attacks between 2020 and 2022, peak years of coronavirus lockdowns. The study is a meta-analysis of 81 reports from sources including Google and BrightTALK.
The pandemic resulted in the remote workforce increasing by a third and a rush by organizations to embrace VPNs, the software and hardware applications that provide encrypted network tunneling over public networks. Almost none of those new VPN users were prepared to fend off the associated cyberthreats, researchers concluded.
Threat actors began actively searching for exposed gateways, data misconfigurations and unpatched vulnerabilities. “Many VPN connections lacked endpoint controls and network segmentation, enabling attackers to move literally across corporate networks,” the researchers said.
Martin Zugec, technical solutions director at Bitdefender, told Information Security Media Group that VPNS “are not necessarily difficult to secure.” But the rapid pace of adoption and companies’ relative inexperience with the technology made management difficult.”
“The problem around security intensified during COVID-19 when organizations of all sizes needed a rapid solution for mass remote access, and VPNs offered the quickest path, despite not being the most secure long-term model. The true difficulty lies in the ongoing management, monitoring and scale required to maintain security across the expanded attack surface,” he said.
According to Zugec, many organizations, especially small- to mid-sized businesses, mistakenly viewed VPN deployment as a security problem “solved,” without taking into account the need for ongoing oversight.
Organizations that introduced VPNs while neglecting to patch, remediate or monitor threats set their networks up for exploitation during and after the pandemic. The post-pandemic rate of VPN attacks have gone down, researchers said – but VPNs remain an ongoing source of risk, as recent customers of SonicWall SSL VPN and Ivanti Connect Secure can attest.
One factor behind the pandemic spike in VPN attacks, the researchers said, is a lack of guidance for VPN customers to execute without an expert to guide them. They proposed a hardening framework for all organizations to follow.
- Strong authentication and access controls
- Multifactor authentication;
- Access control list.
- Robust encryption and tunneling protocols
- IPsec;
- Internet Key Exchange version 2;
- OpenVPN Protocol;
- WireGuard protocol;
- AES256 encryption;
- CRYSTALS-Kyber encryption.
- Secure configuration and patch management
- Keep systems patched;
- Network segmentation.
- Continuous monitoring and auditing
- Log;
- Intrusion detection system and intrusion protection system;
- Penetration testing.