What the M&S attack taught us about VPNs and information security