They failed to implement multi-factor authentication on their VPNs. This is one of the most common attack vectors. VPNs by themselves are not enough. Over two thirds of corporate attacks with VPNs have been through compromised static credentials.
There are numerous ways of integrating VPNs with MFA ranging from a RADIUS integration to a SAML one. At Saas Pass the admin can choose and implement up to 15 different methods of MFA to VPNs ranging from FIDO keys to push approval to scanning encrypted barcodes to SMS (not recommended) etc...
Disclaimer: Worked on the design of some of the mfa interfaces for the SAML based VPNs and the access control policies.
There are numerous ways of integrating VPNs with MFA ranging from a RADIUS integration to a SAML one. At Saas Pass the admin can choose and implement up to 15 different methods of MFA to VPNs ranging from FIDO keys to push approval to scanning encrypted barcodes to SMS (not recommended) etc...
Disclaimer: Worked on the design of some of the mfa interfaces for the SAML based VPNs and the access control policies.