Research on Security Threats Using VPN in Zero Trust Environments

The United States issued an executive order requiring all federal agencies to adopt the Zero Trust security framework, and instructed each federal government department to devise a plan for its implementation. This development has generated a great deal of interest in the Zero Trust security framework in many countries. In Korea, the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) are actively promoting the establishment of guidelines for the implementation of Zero Trust in public institutions. Discussions on policies and models for the introduction of Zero Trust began with the launch of the Zero Trust security forum on October 26, 2022. Accordingly, this paper examines and conducts experiments on security threats that may arise within a Zero Trust environment in the Zero Trust Network Access (ZTNA) system. Despite the adoption of Zero Trust in many network environments, existing firewall or VPN devices are still in use. We discuss potential security threats that Zero Trust environments may encounter due to vulnerabilities in these existing network devices and propose countermeasures to mitigate such threats.