In The Bourne Identity, Jason Bourne is a CIA operative, one of their best. But the moment he goes off the grid and stops authenticating through official CIA channels, something critical happens: the CIA loses the ability to support him, track him, or protect the mission. They can't help what they can't see. Resources dry up. Oversight vanishes. The whole operational picture breaks down because one asset is running without accountability to the infrastructure designed to support, and protect, him.
Your remote workforce is doing the same thing when they connect to enterprise resources without going through your VPN and AAA infrastructure.
What Is CIS Safeguard 12.7?
CIS Safeguard 12.7 requires that remote users authenticate to enterprise-managed VPN and authentication services before accessing enterprise resources on end-user devices.
That's the whole thing. Before you touch company resources from outside the office, files, applications, internal systems, even cloud services, you authenticate through the enterprise-managed VPN, which is integrated with your centralized AAA infrastructure.
This is a CIS Control 12 safeguard, Network Infrastructure Management, rated IG2+3.
Why It Matters
Remote work exploded and a lot of security architectures didn't keep up. The result: employees connecting directly to SaaS apps, cloud resources, and internal systems from home networks, coffee shops, and airports, entirely outside your security controls.
When that happens, you lose a lot at once:
- Visibility. You can't see traffic that doesn't pass through your security stack.
- Control. You can't enforce security policies on connections you don't manage.
- Detection. You can't catch anomalous behavior you're not monitoring.
- Response. You can't protect data you didn't know was being accessed.
An attacker who compromises a remote employee's device and credentials can walk straight into your environment, and you'll have no telemetry on any of it, because the connection never touched your infrastructure.
The VPN + centralized AAA model closes that gap. Every remote connection comes through a chokepoint you control, authenticated against a directory you manage, with logs flowing into your SIEM.
A Note on the "But We Use SaaS" Objection
I hear this one a lot: "Our users go directly to Microsoft 365 / Salesforce / whatever, why do they need a VPN?"
A few reasons. First, SaaS applications may have your data, but they don't have your security controls. Your DLP, your behavioral analytics, your conditional access policies, those layer on top of your managed infrastructure. Second, most organizations have a mix of SaaS and on-premises resources, and the on-premises piece absolutely needs VPN coverage. Third, routing SaaS traffic through your security stack (or using a CASB/SSE solution integrated with your identity infrastructure) gives you consistent visibility regardless of where the application lives.
The architecture may evolve, ZTNA and SSE solutions are increasingly the modern answer, but the principle is the same: remote access should be authenticated, authorized, and auditable through enterprise-managed infrastructure.
How to Get There: Implementation Steps
- Require VPN for all remote access to enterprise resources. This means policy as well as technical enforcement, documenting the requirement and configure your security tools to alert or block access attempts that bypass VPN where feasible.
- Integrate your VPN with centralized AAA. Your VPN concentrator should be authenticating users against your RADIUS server, LDAP/Active Directory, or SAML identity provider, not a local user database. This ties VPN authentication into the same centralized system as the rest of your access controls.
- Enforce MFA on VPN authentication. A username and password alone aren’t sufficient for remote access. Add a second factor, authenticator app, hardware token, or push notification. This is a non-negotiable in 2024.
- Ensure remote device traffic routes through your security stack. Full-tunnel VPN (not split-tunnel, where only some traffic goes through the VPN) ensures all traffic passes through your firewalls, proxies, and inspection tools. If full-tunnel isn't feasible for performance reasons, make sure at minimum that traffic to internal resources is tunneled.
- Monitor and alert on authentication failures and anomalies. Failed VPN authentication attempts, logins from unexpected geographies, off-hours access, these are the signals that matter. Make sure your SIEM is ingesting VPN and AAA logs and has alerting rules in place.
- Audit remote access logs periodically. Who connected, from where, when, and what did they access? Build a regular review into your operations cadence. You're looking for stale accounts, unusual patterns, and devices that are connecting but shouldn't be.
Final Thoughts
The CIA couldn't support Jason Bourne once he went dark, and they certainly couldn't protect him. Your remote employees are mission-critical assets operating in untrusted environments. When they connect outside your VPN and AAA infrastructure, they're off the grid. You lose visibility, control, and the ability to defend them or the data they carry. Get every remote user connecting through enterprise-managed VPN and AAA, and you're back in the operations center, running the full picture, not guessing what you're missing.
Free CIS Controls v8 documentation is available at cisecurity.org. DM me if you want to talk through your remote access architecture, whether you're starting from scratch or hardening what you have.
Official CIS Control and Safeguard Text
CIS Control 12: Network Infrastructure Management
CIS Safeguard 12.7: Require users to authenticate to enterprise-managed VPN and authentication services prior to accessing enterprise resources on end-user devices.
Shameless Marketing Information
Gotham offers remote access security assessments and can help organizations design and implement VPN and AAA solutions that protect remote workers without compromising productivity.