Behind the Fortinet headlines: why now is the time to rethink remote access

Over the past few days, a large-scale campaign has emerged targeting Fortinet firewalls and SSL VPN services. Security researchers have identified almost 74,000 internet facing Fortinet devices that may be exposed, with attackers using stolen usernames and passwords to attempt access at scale.  

The headlines are focused on Fortinet, with organisations such as the BBC, DHL, Spotify, Samsung, Oracle and Sony all reported to be in the firing line. But the wider story is bigger than one vendor. Businesses of every size and from every sector are being targeted, from global brands through to local SMEs, all because attackers are looking for exposed services, weak credentials and opportunities to reuse passwords that have already been compromised elsewhere. 

The National Cyber Security Centre has been clear that this is a credible and active threat, with potential impact in the UK, and is urging organisations to investigate whether they may be affected and to strengthen how access into their systems is controlled. 

A quick note on what’s involved 

To make sense of this, it helps to understand a few of the terms involved. 

A firewall is the main barrier between an organisation’s internal systems and the outside world. It controls what is allowed in and out, and plays a central role in keeping systems protected from unwanted access. 

A VPN, or virtual private network, is a secure way for people to connect into work systems when they are not in the office. It creates a private connection over the internet, so someone working from home can access files, applications and systems as if they were sat at their desk. 

An SSL VPN is one specific type of VPN that has been widely used for many years. It is simple to set up and familiar to users, which is why it remains in place in many organisations today. However, it sits on the edge of the network, is exposed to the internet and typically relies on usernames and passwords as the main form of authentication. 

Internet facing systems are the parts of an organisation’s infrastructure that can be reached directly from the public internet, such as remote access portals and firewalls. They exist for good reason, but because they are accessible from anywhere, they are also the most common target for attackers. 

What is actually happening 

What stands out about this campaign is that it is not about a weakness in the technology itself. Many of the organisations affected are running supported, fully updated systems. The risk sits in how credentials are managed and how remote access is set up, areas that are often shaped by decisions made years ago and quietly left in place since. 

Rather than exploiting a flaw, attackers are using large databases of usernames and passwords gathered from unrelated incidents over many years, and quietly testing them against internet facing services at scale. Where credentials still work, they simply log in . 

That is why the common factor in who is being targeted is not the technology in use, the sector or size of the organisation or its level of technical maturity. It is whether attackers can find a route in using credentials they already possess. 

The uncomfortable reality is that attackers are not trying to break down the door, they are checking whether someone left a key under the mat. 

Why SSL VPN is at the centre of this attack 

The reason SSL VPN keeps appearing in alerts like this is straightforward. It is one of the most common ways people connect into work systems remotely, which means it is also one of the most exposed. When credentials have been leaked or reused elsewhere, attackers can quietly try them against thousands of organisations at once, looking for a way in. 

In many environments, SSL VPN is still in place not because it is the best option, but because it has always been there. As working patterns have changed and threats have evolved, the level of risk attached to that approach has quietly grown. 

Our response and guidance 

The Fortinet campaign is a timely reminder to step back and review how remote access and credentials are being managed. There are a number of practical areas worth looking at, including: 

• ensuring firewall platforms are running supported and fully updated firmware 

• reviewing all internet facing SSL VPN services and whether they are still the right fit 

• enforcing multi-factor authentication across all remote access 

• identifying weak, reused or previously compromised credentials 

• assessing modern alternatives, such as Global Secure Access 

These are sensible steps in their own right, but the bigger opportunity is to look beyond the immediate concern and rethink how access is delivered overall. 

Our position is straightforward and consistent with what we are seeing across the industry. Organisations should update their firewall platforms to the latest supported version and, just as importantly, move away from SSL VPN wherever possible. Patching remains essential, but on its own it does not address the underlying issue. If access is still being provided through methods that are inherently exposed and reliant on passwords alone, the risk remains. 

Where remote access is being reviewed or redesigned, we believe organisations should lead with Global Secure Access (GSA) rather than SSL VPN. GSA is a modern way of enabling secure access to systems, where people are only given access to the specific applications they need, with security checks built in at every stage. Rather than opening a wider connection into the network, it brings access in line with how organisations need to operate today, with stronger controls, better visibility and far less exposure. 

We are also proactively reviewing clients using Fortinet firewalls, analysing access logs and carrying out additional validation checks to identify any signs of unauthorised access. We will also contact clients using SSL VPN technology to discuss alternative access methods and reduce potential risk. 

Looking beyond the immediate threat 

While the headlines are focused on Fortinet today, the wider lesson applies to every organisation with internet facing access services. 

The question is no longer “are our systems patched?” but is “what happens if an attacker already knows a valid password?”. 

The organisations best positioned to defend against modern threats are those that assume passwords alone are no longer enough, and design access around that reality. Modern approaches like Global Secure Access reduce reliance on traditional network-level access and give organisations far tighter control over exactly who can access what, from where and on which device. 

By making these foundations stronger now, organisations are not just responding to a single campaign, they are putting themselves in a better position for everything that comes next. 

Talk to Trident 

If you are not sure where your organisation stands, we can help you understand your current position, identify any areas of exposure and move towards a more secure, modern approach to remote access. 

Talk to Trident about the right next step for your organisation.