If you read the headlines from many technology media and security professionals, you’d be forgiven for believing that the Virtual Private Network (VPN) is dead. The reality – particularly as many of us continue to work remote – is quite different.
Dating back more than 20 years to the first Peer-to-Peer Tunneling Protocol (PPTP) specifications, the legacy VPNs of that era were designed at a time when most people accessed corporate data from the office, with far fewer remote workers and an almost non-existent cloud-based SaaS infrastructure.
Fast forward to 2020 and we have a very mobile, very remote workforce with vastly different remote access needs. Add to that the emergence of zero trust technologies and it’s easy to assume that the VPN has outlived its usefulness. The truth, however, is that the VPN is not only very much alive, use of VPNs has exploded in 2020, and will continue to play a critical role in both the security and the remote work landscape for many years to come.
The reported problem with VPNs
If VPNs are still relevant today, then why have so many people been ringing their death knell prematurely? The argument goes that VPNs aren’t capable of protecting the attack surface of today’s networks. Rather, they are only good at providing secure access to corporate data and applications when a network has a well-defined perimeter. But this kind of environment is less common, due to the popularity of cloud computing, software as a service (SaaS) and the current growth of remote work.
The traditional VPN relies on a set of credentials that allow authenticated users to access corporate data and applications from any location. That’s great in theory, but in practice if an attacker manages to get those credentials, they have almost unfettered (and often unnoticed) access to any corporate resources.
The VPN model also falls flat when it comes to insider threats. According to the most recent Verizon Data Breach Investigations Report, more than 30 per cent of data breaches are the result of employees, acting maliciously or accidentally. And consider this: 80 per cent of data breaches can be attributed to compromised, weak or reused passwords.
Breaking down legacy vs. modern VPNs
Legacy VPNs also aren’t context aware. To highlight this, if the credentials of an Atlanta-based employee (who normally doesn’t travel) are suddenly being used to log into the corporate network at 1:30 a.m. Eastern Time, from Turkey, then this should naturally raise a red flag. Unfortunately, traditional VPNs can’t do this.
Also worth mentioning is that traditional VPNs are costly, often requiring dedicated hardware that is time-consuming to deploy and not scalable when needs spike. As many newly remote workers have recently discovered, old-school VPNs can negatively impact network performance by forcing all data down the ‘tunnel,’ even when that data (such as many SaaS apps) can safely be sent directly to the Internet. Simply put, being either ‘on’ or ‘off’ doesn’t cut it.
One important thing worth pointing out is that not all VPNs are created equal. There is a new breed of modern, highly scalable and context-aware VPNs that are designed specifically for mobile workforces. These VPNs can complement or even incorporate elements of a zero-trust architecture, which in the VPN space is also often referred to as a “Software-Defined Perimeter” (SDP).
You might want to check out the best business VPN.
Context aware VPN is the future
The zero-trust model only allows users and their devices to access services and data only if they can meet certain criteria. Such rules take into account many factors, including the:
- individual’s role and level of ‘clearance’
- ID of the device
- type of application or data they’re attempting to access,
- user’s location and time of day, t
- type of network (public Wi-Fi, cellular, etc.).
The key takeaway is that the threshold for accepting a user’s request can be managed to an extremely granular level, even if they’ve already provided valid username and password credentials.
Here’s an example. A properly authenticated member of the sales team would be granted access to Salesforce during normal business hours using a corporate-owned device in the city where they live. This wouldn’t be suspicious. But a person from engineering trying to access Salesforce in the middle of the night, perhaps from a different country, would certainly raise a red flag.
Unlike traditional VPNs alone, the SDP solution recognises legitimate users and can turn on a VPN tunnel on the fly.
Enterprise VPNs have a role among ZTNA, SDP
This zero-trust framework is still a relatively new concept, governing the ways that security and access should work. Products based on SDP or Zero Trust Network Access (ZTNA) are still in their infancy, but they are starting to appear on the market. Like any new technology, it can be expensive and difficult to implement. In its 2019 Hype Cycle, Gartner put SDP/ZTNA just over the initial hype peak, meaning that it’s still up to five years away from providing real business value for early adopters.
Contrast that with VPNs technology, which is extremely mature and used by a majority of enterprises. Analyst firm Research and Markets estimates that VPNs will continue to see a CAGR of 15 per cent until 2024. It’s also worth noting that companies wanting to move to a zero-trust framework will probably require several years of planning and evaluation, and possibly even longer for large, well-entrenched organisations that tend to be more cautious.
In summary, VPNs aren’t dead, but they are evolving. Traditional VPN solutions are likely to be phased out in favour of more flexible, scalable solutions. It will take many years for mature SDP products to replace them, and for large enterprises to fully embrace them.
Users in the future will have the best of both worlds; protection on any device and any network, with an on-demand VPN connection that can be deployed back to the enterprise whenever it’s needed. The future looks bright for VPNs for many years to come.
You might also want to check out the best VPN.
Joel Windels, CMO, NetMotion
