Research on Security Threats Using VPN in Zero Trust Environments

Eunyoung Kim; Kiwook Sohn

doi:10.1007/978-981-99-8024-6_5

Research on Security Threats Using VPN in Zero Trust Environments

Eunyoung Kim
, Kiwook Sohn

Dept. of Computer Science and Engineering

National Security Research Institute, Korea

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

2 Scopus citations

Abstract

The United States issued an executive order requiring all federal agencies to adopt the Zero Trust security framework, and instructed each federal government department to devise a plan for its implementation. This development has generated a great deal of interest in the Zero Trust security framework in many countries. In Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) are actively promoting the establishment of guidelines for the implementation of Zero Trust in public institutions. Discussions on policies and models for the introduction of Zero Trust began with the launch of the Zero Trust security forum on October 26, 2022. Accordingly, this paper examines and conducts experiments on security threats that may arise within a Zero Trust environment in the Zero Trust Network Access (ZTNA) system. Despite the adoption of Zero Trust in many network environments, existing firewall or VPN devices are still in use. We discuss potential security threats that Zero Trust environments may encounter due to vulnerabilities in these existing network devices and propose countermeasures to mitigate such threats.

Original language	English
Title of host publication	Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers
Editors	Howon Kim, Jonghee Youn
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	55-66
Number of pages	12
ISBN (Print)	9789819980239
DOIs	https://doi.org/10.1007/978-981-99-8024-6_5
State	Published - 2024
Event	24th International Conference on Information Security Applications, WISA 2023 - Jeju Island, Korea, Republic of Duration: 23 Aug 2023 → 25 Aug 2023

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	14402 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	24th International Conference on Information Security Applications, WISA 2023
Country/Territory	Korea, Republic of
City	Jeju Island
Period	23/08/23 → 25/08/23

UN SDGs

This output contributes to the following UN Sustainable Development Goals (SDGs)

SDG 16 Peace, Justice and Strong Institutions

Keywords

Firmware
Security Threats
VPN
Vulnerability
Zero Trust Network Access

Access to Document

10.1007/978-981-99-8024-6_5

Cite this

Kim, E., & Sohn, K. (2024). Research on Security Threats Using VPN in Zero Trust Environments. In H. Kim, & J. Youn (Eds.), Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers (pp. 55-66). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 14402 LNCS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-981-99-8024-6_5

Kim, Eunyoung ; Sohn, Kiwook. / Research on Security Threats Using VPN in Zero Trust Environments. Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers. editor / Howon Kim ; Jonghee Youn. Springer Science and Business Media Deutschland GmbH, 2024. pp. 55-66 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{591e81bb8de4413d82c09c78e892d128,

title = "Research on Security Threats Using VPN in Zero Trust Environments",

abstract = "The United States issued an executive order requiring all federal agencies to adopt the Zero Trust security framework, and instructed each federal government department to devise a plan for its implementation. This development has generated a great deal of interest in the Zero Trust security framework in many countries. In Korea, the Ministry of Science and ICT and the Korea Internet \& Security Agency (KISA) are actively promoting the establishment of guidelines for the implementation of Zero Trust in public institutions. Discussions on policies and models for the introduction of Zero Trust began with the launch of the Zero Trust security forum on October 26, 2022. Accordingly, this paper examines and conducts experiments on security threats that may arise within a Zero Trust environment in the Zero Trust Network Access (ZTNA) system. Despite the adoption of Zero Trust in many network environments, existing firewall or VPN devices are still in use. We discuss potential security threats that Zero Trust environments may encounter due to vulnerabilities in these existing network devices and propose countermeasures to mitigate such threats.",

keywords = "Firmware, Security Threats, VPN, Vulnerability, Zero Trust Network Access",

author = "Eunyoung Kim and Kiwook Sohn",

note = "Publisher Copyright: {\textcopyright} 2024, The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.; 24th International Conference on Information Security Applications, WISA 2023 ; Conference date: 23-08-2023 Through 25-08-2023",

year = "2024",

doi = "10.1007/978-981-99-8024-6\_5",

language = "English",

isbn = "9789819980239",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "55--66",

editor = "Howon Kim and Jonghee Youn",

booktitle = "Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers",

}

Kim, E & Sohn, K 2024, Research on Security Threats Using VPN in Zero Trust Environments. in H Kim & J Youn (eds), Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 14402 LNCS, Springer Science and Business Media Deutschland GmbH, pp. 55-66, 24th International Conference on Information Security Applications, WISA 2023, Jeju Island, Korea, Republic of, 23/08/23. https://doi.org/10.1007/978-981-99-8024-6_5

Research on Security Threats Using VPN in Zero Trust Environments. / Kim, Eunyoung; Sohn, Kiwook.
Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers. ed. / Howon Kim; Jonghee Youn. Springer Science and Business Media Deutschland GmbH, 2024. p. 55-66 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 14402 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - Research on Security Threats Using VPN in Zero Trust Environments

AU - Kim, Eunyoung

AU - Sohn, Kiwook

PY - 2024

Y1 - 2024

N2 - The United States issued an executive order requiring all federal agencies to adopt the Zero Trust security framework, and instructed each federal government department to devise a plan for its implementation. This development has generated a great deal of interest in the Zero Trust security framework in many countries. In Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) are actively promoting the establishment of guidelines for the implementation of Zero Trust in public institutions. Discussions on policies and models for the introduction of Zero Trust began with the launch of the Zero Trust security forum on October 26, 2022. Accordingly, this paper examines and conducts experiments on security threats that may arise within a Zero Trust environment in the Zero Trust Network Access (ZTNA) system. Despite the adoption of Zero Trust in many network environments, existing firewall or VPN devices are still in use. We discuss potential security threats that Zero Trust environments may encounter due to vulnerabilities in these existing network devices and propose countermeasures to mitigate such threats.

AB - The United States issued an executive order requiring all federal agencies to adopt the Zero Trust security framework, and instructed each federal government department to devise a plan for its implementation. This development has generated a great deal of interest in the Zero Trust security framework in many countries. In Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) are actively promoting the establishment of guidelines for the implementation of Zero Trust in public institutions. Discussions on policies and models for the introduction of Zero Trust began with the launch of the Zero Trust security forum on October 26, 2022. Accordingly, this paper examines and conducts experiments on security threats that may arise within a Zero Trust environment in the Zero Trust Network Access (ZTNA) system. Despite the adoption of Zero Trust in many network environments, existing firewall or VPN devices are still in use. We discuss potential security threats that Zero Trust environments may encounter due to vulnerabilities in these existing network devices and propose countermeasures to mitigate such threats.

KW - Firmware

KW - Security Threats

KW - VPN

KW - Vulnerability

KW - Zero Trust Network Access

UR - https://www.scopus.com/pages/publications/85182597337

U2 - 10.1007/978-981-99-8024-6_5

DO - 10.1007/978-981-99-8024-6_5

M3 - Conference contribution

AN - SCOPUS:85182597337

SN - 9789819980239

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 55

EP - 66

BT - Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers

A2 - Kim, Howon

A2 - Youn, Jonghee

PB - Springer Science and Business Media Deutschland GmbH

T2 - 24th International Conference on Information Security Applications, WISA 2023

Y2 - 23 August 2023 through 25 August 2023

ER -

Kim E, Sohn K. Research on Security Threats Using VPN in Zero Trust Environments. In Kim H, Youn J, editors, Information Security Applications - 24th International Conference, WISA 2023, Jeju Island, South Korea, August 23–25, 2023, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2024. p. 55-66. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-981-99-8024-6_5