VPN

A VPN creates a protected connection over an infrastructure that cannot be trusted, usually the internet. Data in the tunnel cannot be read by third parties in transit and cannot be changed unnoticed. In companies, the VPN has two main tasks: connecting mobile employees to the corporate network and linking sites with each other. These should be distinguished from VPN services for private individuals, which are mainly intended to conceal one's own location.

How does a VPN work?

Two endpoints authenticate each other, for example with certificates, a pre-shared key or a user sign-in. They then negotiate keys and encrypt the data traffic. The original data packets are wrapped in new packets and only unwrapped again at the remote end.

• Site-to-site VPN: Two networks, such as headquarters and a branch or the corporate network and a cloud network, are permanently connected via their gateways. IPsec is usually used here.
• Remote access VPN: A client on the laptop establishes the connection to the VPN gateway, often the company's firewall. IPsec, TLS-based methods and WireGuard are common.
• Full tunnel or split tunneling: Either all traffic runs through the VPN, or only the traffic intended for the corporate network.

Typical examples

• Employees working from home access the file server and the ERP system in the corporate network.
• A branch is permanently connected to headquarters.
• The local network is linked to virtual networks in the cloud.
• A machine manufacturer maintains its plant via a dedicated access.

What companies should keep in mind

• Keep gateways up to date: VPN gateways are directly reachable from the internet and a frequent target of attacks. Security updates should be installed immediately.
• Require multiple factors: A password alone is not enough for access to the corporate network, see multi-factor authentication.
• Limit access: After sign-in, only release the systems that are needed. Network segmentation helps with this.
• Control external access: Limit service provider access in time, personalize it and log it.
• Monitor sign-ins: Evaluate unusual times, countries of origin or repeated failed attempts.

How it differs

A classic VPN connects to an entire network. Approaches based on the zero trust principle, often called zero trust network access, by contrast only grant access to individual applications and check identity and device on every access.