Senator Wyden Urges Federal Agencies to Replace Outdated VPNs with Zero-Trust Architecture

Call to Action for Federal Cybersecurity

Senator Ron Wyden (D-OR) has issued a directive to the Cybersecurity and Infrastructure Security Agency (CISA), the Office of Management and Budget (OMB), and the National Institute of Standards and Technology (NIST). Wyden urged these agencies to spearhead an initiative to eliminate public internet-facing and insecure virtual private networks (VPNs) from government systems.

Addressing Legacy VPN Vulnerabilities

Wyden highlighted that federal agencies and contractors have experienced cyberattacks due to their reliance on legacy, insecure VPN servers for remote access. He cited recent hacking campaigns that targeted VPNs and remote-access systems from vendors including Cisco, Fortinet, Ivanti, and Check Point. These vulnerable VPNs are considered high-risk due to their lack of modern safeguards, allowing foreign adversaries to gain administrative access and steal sensitive data.

Transition to Zero-Trust Architecture

To mitigate these risks, Wyden, a member of the Senate Intelligence Committee, proposed a transition to zero-trust architectures. He recommended that CISA set a two-year deadline for civilian agencies to replace public-facing remote access systems with zero-trust solutions. The National Security Agency (NSA) is also urged to mandate a similar purge for all legacy remote access gateways across military, intelligence, and national security networks.

Standardization and Investment

Wyden also pressed NIST to develop implementation standards for agencies migrating to zero-trust architectures, which involve continuous user verification and assume potential network breaches. Additionally, he directed OMB to draft a memo instructing federal agencies to invest in zero-trust infrastructure to enhance their cybersecurity posture.