Contractors on Your VPN? Why "Encrypted" Doesn't Mean Safe

Your contractors connect from their own laptops, over the VPN, straight onto your internal network, and some of them have admin rights. In this Fix This Architecture episode I take one company from the first 30-minute call to the 90-day check, and show the three changes that close the gap. XYZ is an illustrative scenario. The facts about real standards, advisories and breaches are sourced below. 📅 Book a free 30-min security architecture call: https://calendly.com/anishonsecurity/... 💼 LinkedIn:   / anishonsecurity   ✉️ Me@AnishOnSecurity.com CHAPTERS 0:00 Cold open: "Our contractors are on our VPN" 0:48 AnishOnSecurity intro 1:09 Stage 0: the discovery meeting 2:29 Stages 1–3: scoping, proposal and pre-engagement 3:11 Stage 4: delivery, what we found 5:50 Stage 4: delivery, the redesign 8:23 Stage 5: readout and acceptance 8:56 Stage 6: close and follow-up 9:24 Key takeaway: three questions to ask 10:17 Closing SOURCES 1. Mandiant (Google Cloud) – UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (June 2024): https://cloud.google.com/blog/topics/... 2. NIST – SP 800-207, Zero Trust Architecture (August 2020): https://csrc.nist.gov/pubs/sp/800/207... 3. NSA & CISA – Top Ten Cybersecurity Misconfigurations, AA23-278A (October 2023): https://www.cisa.gov/news-events/cybe... 4. CISA – CISA Issues Emergency Directive on Ivanti Vulnerabilities (January 2024): https://www.cisa.gov/news-events/aler... 5. FedRAMP – CISA Emergency Directive 24-01 (January 2024): https://www.fedramp.gov/archive/2024-... About AnishOnSecurity: security architecture explained in plain language by an enterprise security architect with 20+ years of experience. Assess · Design · Support. #ZeroTrust #CyberSecurity #SecurityArchitecture