{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/hybrid-network-access-vpn-least-privilege/", "item": { "id": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "slug": "hybrid-network-access-vpn-least-privilege", "url": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege.md", "json": "https://update.dsesecurity.com/api/v1/posts/hybrid-network-access-vpn-least-privilege/" }, "title": "Reassess broad VPN access for a hybrid, least-privilege environment", "summary": "Modern network-access guidance asks organizations to examine broad remote connectivity and compare risk-based, resource-level approaches without assuming every VPN requires replacement.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "advisory", "name": "Advisory" }, "featured": false, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-07-19T21:27:10+00:00", "modified_at": "2026-07-19T21:27:10+00:00", "reviewed_on": "2026-07-19", "reading_minutes": 2, "word_count": 437, "potentially_affected": "Organizations using remote-access VPNs, cloud applications, hybrid networks, partner connectivity, remote administration, operational technology, SSE, SASE, or zero-trust access.", "dse_recommendation": "Inventory current access, map required resources, assess VPN and modern alternatives, design least-privilege policy, pilot operational behavior, and remove obsolete broad reachability.", "primary_source": { "name": "CISA and partners: Modern Approaches to Network Access Security", "url": "https://www.cisa.gov/news-events/alerts/2024/06/18/cisa-and-partners-release-guidance-modern-approaches-network-access-security", "published_on": "2024-06-18", "authority": "Cybersecurity and Infrastructure Security Agency" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "
\n

A remote-access design created for an on-premises network may grant more reach than a user needs in a hybrid environment. Modernization should begin with required business transactions and risk, not an assumption that a new service category is automatically safer.

\n\n

What the joint guidance says

\n

Source fact: CISA, FBI, and international partners published Modern Approaches to Network Access Security to help organizations understand vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, including business risk from misconfiguration.

\n

Source fact: The guidance encourages businesses of all sizes to evaluate approaches such as zero trust, Secure Service Edge, and Secure Access Service Edge. These architectures can provide greater activity visibility and more granular, risk-based access control through policy decisions. The guide addresses hybrid and cloud transitions and considers both IT and operational-technology networks.

\n

The agencies do not state that every VPN is inherently insecure or order every organization to replace one. They call for careful analysis of changing security needs and the risks of broad or misconfigured remote access.

\n\n

Map access at the resource level

\n

DSE recommendation: inventory every remote-access path, gateway, exposed management interface, VPN product, version, support state, authentication method, user and service identity, reachable route, privileged function, logging source, and emergency dependency. Identify unused paths and access that is broad only because the existing architecture makes narrowing difficult.

\n
    \n
  1. Map users, devices, partners, administrators, and services to the specific applications and transactions they require.
    2. \n
  2. Document security, privacy, data-location, latency, availability, offline, safety, support, inspection, and logging requirements.
    3. \n
  3. Compare a hardened retained VPN, resource-level zero-trust access, SSE, SASE, and hybrid combinations against those requirements.
    4. \n
  4. Define least-privilege and context-aware policy, strong authentication, device expectations, session controls, and independent telemetry.
    5. \n
  5. Preserve a tested emergency and rollback path that does not silently restore unnecessary broad access.
    6. \n
\n\n

Pilot the operating failure modes

\n

DSE recommendation: pilot with bounded users and resources. Test ordinary and privileged workflows, unmanaged or noncompliant devices, provider outage, identity outage, policy error, application incompatibility, latency, failover, investigation visibility, help-desk recovery, and rollback. Review denies and exceptions before expanding.

\n

After migration, remove obsolete routes, accounts, gateways, split tunnels, and firewall rules through change control. Continue monitoring vulnerabilities, support status, policy drift, unexpected destinations, and access that no longer has a business owner.

\n\n

Applicability and limits

\n

SSE and SASE describe architectural approaches, not guaranteed outcomes or certifications. Some environments will retain VPN connectivity because of application, availability, OT, performance, or support constraints. Vendor features and CISA’s dated vulnerability counts can change; use the current KEV catalog and current vendor information for decisions.

\n\n

Official reference

\n

Modern Approaches to Network Access Security — joint guidance on VPN risk and resource-focused alternatives.

\n
", "content_text": "A remote-access design created for an on-premises network may grant more reach than a user needs in a hybrid environment. Modernization should begin with required business transactions and risk, not an assumption that a new service category is automatically safer.\n\n What the joint guidance says\n Source fact: CISA, FBI, and international partners published Modern Approaches to Network Access Security to help organizations understand vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, including business risk from misconfiguration.\n Source fact: The guidance encourages businesses of all sizes to evaluate approaches such as zero trust, Secure Service Edge, and Secure Access Service Edge. These architectures can provide greater activity visibility and more granular, risk-based access control through policy decisions. The guide addresses hybrid and cloud transitions and considers both IT and operational-technology networks.\n The agencies do not state that every VPN is inherently insecure or order every organization to replace one. They call for careful analysis of changing security needs and the risks of broad or misconfigured remote access.\n\n Map access at the resource level\n DSE recommendation: inventory every remote-access path, gateway, exposed management interface, VPN product, version, support state, authentication method, user and service identity, reachable route, privileged function, logging source, and emergency dependency. Identify unused paths and access that is broad only because the existing architecture makes narrowing difficult.\n \n Map users, devices, partners, administrators, and services to the specific applications and transactions they require.\n Document security, privacy, data-location, latency, availability, offline, safety, support, inspection, and logging requirements.\n Compare a hardened retained VPN, resource-level zero-trust access, SSE, SASE, and hybrid combinations against those requirements.\n Define least-privilege and context-aware policy, strong authentication, device expectations, session controls, and independent telemetry.\n Preserve a tested emergency and rollback path that does not silently restore unnecessary broad access.\n \n\n Pilot the operating failure modes\n DSE recommendation: pilot with bounded users and resources. Test ordinary and privileged workflows, unmanaged or noncompliant devices, provider outage, identity outage, policy error, application incompatibility, latency, failover, investigation visibility, help-desk recovery, and rollback. Review denies and exceptions before expanding.\n After migration, remove obsolete routes, accounts, gateways, split tunnels, and firewall rules through change control. Continue monitoring vulnerabilities, support status, policy drift, unexpected destinations, and access that no longer has a business owner.\n\n Applicability and limits\n SSE and SASE describe architectural approaches, not guaranteed outcomes or certifications. Some environments will retain VPN connectivity because of application, availability, OT, performance, or support constraints. Vendor features and CISA’s dated vulnerability counts can change; use the current KEV catalog and current vendor information for decisions.\n\n Official reference\n Modern Approaches to Network Access Security — joint guidance on VPN risk and resource-focused alternatives.", "content_markdown": "A remote-access design created for an on-premises network may grant more reach than a user needs in a hybrid environment. Modernization should begin with required business transactions and risk, not an assumption that a new service category is automatically safer.\n\n## What the joint guidance says\n\nSource fact: CISA, FBI, and international partners published Modern Approaches to Network Access Security to help organizations understand vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, including business risk from misconfiguration.\n\nSource fact: The guidance encourages businesses of all sizes to evaluate approaches such as zero trust, Secure Service Edge, and Secure Access Service Edge. These architectures can provide greater activity visibility and more granular, risk-based access control through policy decisions. The guide addresses hybrid and cloud transitions and considers both IT and operational-technology networks.\n\nThe agencies do not state that every VPN is inherently insecure or order every organization to replace one. They call for careful analysis of changing security needs and the risks of broad or misconfigured remote access.\n\n## Map access at the resource level\n\nDSE recommendation: inventory every remote-access path, gateway, exposed management interface, VPN product, version, support state, authentication method, user and service identity, reachable route, privileged function, logging source, and emergency dependency. Identify unused paths and access that is broad only because the existing architecture makes narrowing difficult.\n\n- Map users, devices, partners, administrators, and services to the specific applications and transactions they require.\n\n- Document security, privacy, data-location, latency, availability, offline, safety, support, inspection, and logging requirements.\n\n- Compare a hardened retained VPN, resource-level zero-trust access, SSE, SASE, and hybrid combinations against those requirements.\n\n- Define least-privilege and context-aware policy, strong authentication, device expectations, session controls, and independent telemetry.\n\n- Preserve a tested emergency and rollback path that does not silently restore unnecessary broad access.\n\n## Pilot the operating failure modes\n\nDSE recommendation: pilot with bounded users and resources. Test ordinary and privileged workflows, unmanaged or noncompliant devices, provider outage, identity outage, policy error, application incompatibility, latency, failover, investigation visibility, help-desk recovery, and rollback. Review denies and exceptions before expanding.\n\nAfter migration, remove obsolete routes, accounts, gateways, split tunnels, and firewall rules through change control. Continue monitoring vulnerabilities, support status, policy drift, unexpected destinations, and access that no longer has a business owner.\n\n## Applicability and limits\n\nSSE and SASE describe architectural approaches, not guaranteed outcomes or certifications. Some environments will retain VPN connectivity because of application, availability, OT, performance, or support constraints. Vendor features and CISA’s dated vulnerability counts can change; use the current KEV catalog and current vendor information for decisions.\n\n## Official reference\n\n[Modern Approaches to Network Access Security](https://www.cisa.gov/news-events/alerts/2024/06/18/cisa-and-partners-release-guidance-modern-approaches-network-access-security) — joint guidance on VPN risk and resource-focused alternatives." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo.png" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "url": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-07-19" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Reassess broad VPN access for a hybrid, least-privilege environment", "item": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/#article", "identifier": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "url": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/", "headline": "Reassess broad VPN access for a hybrid, least-privilege environment", "description": "Modern network-access guidance asks organizations to examine broad remote connectivity and compare risk-based, resource-level approaches without…", "abstract": "Modern network-access guidance asks organizations to examine broad remote connectivity and compare risk-based, resource-level approaches without assuming every VPN requires replacement.", "articleBody": "A remote-access design created for an on-premises network may grant more reach than a user needs in a hybrid environment. Modernization should begin with required business transactions and risk, not an assumption that a new service category is automatically safer.\n\n What the joint guidance says\n Source fact: CISA, FBI, and international partners published Modern Approaches to Network Access Security to help organizations understand vulnerabilities, threats, and practices associated with traditional remote access and VPN deployment, including business risk from misconfiguration.\n Source fact: The guidance encourages businesses of all sizes to evaluate approaches such as zero trust, Secure Service Edge, and Secure Access Service Edge. These architectures can provide greater activity visibility and more granular, risk-based access control through policy decisions. The guide addresses hybrid and cloud transitions and considers both IT and operational-technology networks.\n The agencies do not state that every VPN is inherently insecure or order every organization to replace one. They call for careful analysis of changing security needs and the risks of broad or misconfigured remote access.\n\n Map access at the resource level\n DSE recommendation: inventory every remote-access path, gateway, exposed management interface, VPN product, version, support state, authentication method, user and service identity, reachable route, privileged function, logging source, and emergency dependency. Identify unused paths and access that is broad only because the existing architecture makes narrowing difficult.\n \n Map users, devices, partners, administrators, and services to the specific applications and transactions they require.\n Document security, privacy, data-location, latency, availability, offline, safety, support, inspection, and logging requirements.\n Compare a hardened retained VPN, resource-level zero-trust access, SSE, SASE, and hybrid combinations against those requirements.\n Define least-privilege and context-aware policy, strong authentication, device expectations, session controls, and independent telemetry.\n Preserve a tested emergency and rollback path that does not silently restore unnecessary broad access.\n \n\n Pilot the operating failure modes\n DSE recommendation: pilot with bounded users and resources. Test ordinary and privileged workflows, unmanaged or noncompliant devices, provider outage, identity outage, policy error, application incompatibility, latency, failover, investigation visibility, help-desk recovery, and rollback. Review denies and exceptions before expanding.\n After migration, remove obsolete routes, accounts, gateways, split tunnels, and firewall rules through change control. Continue monitoring vulnerabilities, support status, policy drift, unexpected destinations, and access that no longer has a business owner.\n\n Applicability and limits\n SSE and SASE describe architectural approaches, not guaranteed outcomes or certifications. Some environments will retain VPN connectivity because of application, availability, OT, performance, or support constraints. Vendor features and CISA’s dated vulnerability counts can change; use the current KEV catalog and current vendor information for decisions.\n\n Official reference\n Modern Approaches to Network Access Security — joint guidance on VPN risk and resource-focused alternatives.", "datePublished": "2026-07-19T21:27:10+00:00", "dateModified": "2026-07-19T21:27:10+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/hybrid-network-access-vpn-least-privilege/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@id": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": "https://update.dsesecurity.com/assets/dse-updates-share.png", "articleSection": [ "Cybersecurity", "IT", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "IT", "Networks & Infrastructure", "Guide", "Advisory priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 437, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "CISA and partners: Modern Approaches to Network Access Security", "url": "https://www.cisa.gov/news-events/alerts/2024/06/18/cisa-and-partners-release-guidance-modern-approaches-network-access-security", "datePublished": "2024-06-18" } } ] } }