Unit 10: Edge devices and remote access · Lesson 4 of 5 · 18 min
Case file: the forgotten VPN account
Review every remote access account for missing MFA and inactivity, and pick the ones to disable today.
case file
Colonial Pipeline Legacy VPN Account
Colonial Pipeline · 2021
In May 2021 DarkSide ransomware affiliates disrupted Colonial Pipeline, which halted pipeline operations for nearly a week and paid a $4.4 million ransom. The CEO testified to the US Senate that attackers entered on or around 29 April through a legacy VPN profile that was no longer in use but still active and protected only by a password, with no multifactor authentication. The password was later found in a batch of leaked credentials, suggesting reuse, though how it was obtained was not determined.
What went wrong
A dormant but active remote access account that required only a password and was not covered by MFA or account lifecycle reviews.
What would have stopped it
- Enforce MFA on all remote access, with no legacy exceptions.
- Account lifecycle management that disables unused VPN profiles and accounts.
- Monitor for organizational credentials appearing in breach dumps and force resets.
- Segment IT from operational technology so IT ransomware does not force OT shutdown.
What defenders could have seen
- Successful VPN login on an account with no recent activity.
- VPN authentication without an MFA event recorded.
- Credential exposure alerts from breach monitoring services.
mission
- You are
- The engineer running the quarterly access review.
- Situation
- Colonial Pipeline was disrupted through a legacy VPN profile that nobody used but that was still active, with a password and no MFA. This lab is modelled on that case.
- Goal
- Find active accounts without MFA, and active accounts unused for more than 90 days as of 2026-10-14.
- Hand in
- The accounts to disable and the ones to move to phishing-resistant MFA.
Three questions for every remote access account
- Is it active?disabled accounts are out of scope
- Does it have MFA?none means one stolen password is enough
- Was it used in 90 days?if not, disable it
Filter to active accounts without MFA
Sort or filter the mfa column for none and check the status column.
you should see Four active accounts have no MFA: legacy-ops, vendor-hvac, svc-backup and old-admin.
Check last login
Compare last_login with 2026-10-14. Anything before 2026-07-16 is more than 90 days old.
you should see legacy-ops and old-admin have not been used for months and have no owner.
defender tip Accounts with no owner are the ones that survive every reorganisation. Make an owner a requirement for an account to exist.
Look for weak MFA
SMS codes can be stolen by SIM swapping and phishing pages. Find the account that still uses them.
you should see j.wu uses SMS.
Set the rule for next quarter
Disable any remote access account with no login in 90 days or no owner, and block sign-in for any account without MFA.
you should see A written policy and the four accounts to fix today.
What a defender takes away
- 1Disable remote access accounts that are unused or unowned.
- 2No remote access without MFA, including vendor and service accounts.
- 3Prefer phishing-resistant MFA such as FIDO2 security keys.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.