How does a VPN work?
A VPN provides a secure, encrypted connection between two points. Before setting up the VPN connection, the two endpoints of the connection create a shared encryption key. This can be accomplished by providing a user with a password or using a key sharing algorithm.
Once the key has been shared, it can be used to encrypt all traffic flowing over the VPN link. For example, a client machine will encrypt data and send it to the other VPN endpoint. At this location, the data will be decrypted and forwarded on to its destination. When the destination server sends a response, the entire process will be completed in reverse.
Types of VPNs
VPNs are designed to provide a private, encrypted connection between two points – but does not specify what these points should be. This makes it possible to use VPNs in a few different contexts:
- Site-to-Site VPN: A site-to-site VPN is designed to securely connect two geographically-distributed sites. VPN functionality is included in most security gateways today. For instance a next-generation firewall (NGFW) deployed at the perimeter of a network protects the corporate network and also serves as a VPN gateway. All traffic flowing from one site to the other passes through this gateway, which encrypts the traffic sent to the gateway at the other site. This gateway decrypts the data and forwards it on to its destination.
- Remote Access VPN: A remote access VPN is designed to link remote users securely to a corporate network. For instance when the COVID-19 pandemic emerged in 2020, many organizations transitioned to a remote workforce, and set up secure remote access VPNs from the remote clients to connect to critical business operations at the corporate site.
- VPN as a Service: VPN as a Service or a cloud VPN is a VPN hosted in cloud-based infrastructure where packets from the client enter the Internet from that cloud infrastructure instead of the client’s local address. Consumer VPNs commonly use this model, enabling users to protect themselves while connecting to the Internet via insecure public Wi-Fi and provide some anonymity while accessing the Internet.
Benefits of a VPN
VPNs can provide users and companies with a number of benefits, such as:
- Secure Connectivity: A VPN’s encrypted connection makes it impossible for a third party to eavesdrop on the connection without knowledge of the secret keys used for encryption and securing the data while in transit.
- Simplified Distributed Networks: Any computers accessible from the public Internet need to have public IP addresses – either directly or via Network Address Translation (NAT). A site-to-site VPN simulates a direct connection between the two networks, enabling them to use private IP addresses for internal traffic.
- Access Control: Every organization has systems and resources that are designed to only be accessible to internal users. A VPN provides a remote user or site with “internal” access – since the VPN endpoint is inside the network firewall – making it possible to allow access to these resources to authorized remote users without making these resources publicly accessible.
Is a VPN Secure?
A VPN uses cryptography to provide its security and privacy guarantees. In this way, VPNs can meet the three criteria of information security:
- Confidentiality: Data privacy is ensured by encrypting all data flowing over the public network.
- Message Integrity: Message authentication codes (MACs) ensure that any modifications or errors in transmitted data are detectable. In short, this detects when a message is tampered with or interfered with in some way, either intentionally or unintentionally.
- Authentication: The initial authentication and key sharing process proves the identity of both endpoints of the VPN connection, preventing unauthorized use of the VPN.
By providing all of the features of the “CIA triad”, VPNs ensure a secure and private connection for their users.
Limitations and Security Risks of VPNs
While VPNs are designed to fill a vital role for the modern business, they are not a perfect solution. VPNs have several limitations that impact their usability and corporate cybersecurity, including:
- Fragmented Visibility: VPNs are designed to provide secure point to point connectivity with every VPN user on their own link. This makes it difficult for an organization’s security team to maintain the full network visibility required for effective threat detection and response.
- No Integrated Security: An organization must deploy additional security solutions behind the VPN to identify and block malicious content and to implement additional access controls.
- Inefficient Routing: VPNs can be used in a “hub and spoke” model to ensure that all traffic flows through the organization’s centralized security stack for inspection. As remote work and cloud applications become more common, this detour may not be the optimal path between the client and the cloud application or the Internet. Learn more about the SD-WAN vs VPN debate.
- Poor Scalability: As a point-to-point security solution, VPNs scale poorly. For example, the number of site-to-site VPN connections in a fully-connected network grows exponentially with the number of sites. This creates a complex network infrastructure that is difficult to deploy, monitor and secure.
- Endpoint Vulnerabilities: Endpoints who have legitimate access to the VPN can sometimes be compromised via phishing and other cyber attacks. Since the endpoint has full access to the VPN resources, so does the threat actor who has compromised the endpoint.
Many organizations require secure remote access solutions, and these VPN limitations make the search for VPN alternatives a priority. To learn about how to deploy secure remote access in your network, contact us. And don’t hesitate to request a free trial of Check Point’s remote workforce security solutions to learn how they can help to improve the productivity and security of your organization’s teleworkers.
I'm a cybersecurity expert with extensive knowledge in the field, and I'll delve into the concepts mentioned in the article about how VPNs work and their various aspects.
VPN Overview: A VPN, or Virtual Private Network, establishes a secure, encrypted connection between two points. Before the connection is set up, both endpoints create a shared encryption key. This key, obtained through a password or key sharing algorithm, is then used to encrypt all traffic flowing over the VPN link. The process involves encrypting data on the client machine, transmitting it to the VPN endpoint, decryption at the destination, and vice versa.
Types of VPNs:
- Site-to-Site VPN: Connects two geographically-distributed sites securely, often using next-generation firewalls as VPN gateways.
- Remote Access VPN: Links remote users securely to a corporate network, particularly relevant during events like the COVID-19 pandemic when remote work surged.
- VPN as a Service (Cloud VPN): Hosted in cloud-based infrastructure, providing secure connections for users, commonly used in consumer VPNs.
Benefits of a VPN:
- Secure Connectivity: Encryption ensures third parties cannot eavesdrop on the connection.
- Simplified Distributed Networks: Enables private IP addresses for internal traffic between connected networks.
- Access Control: Grants remote users "internal" access, allowing authorized access to specific resources.
VPN Security: A VPN utilizes cryptography to meet the three criteria of information security:
- Confidentiality: Ensured by encrypting data.
- Message Integrity: Maintained through message authentication codes (MACs).
- Authentication: Identity verification of both VPN endpoints prevents unauthorized use.
Limitations and Security Risks:
- Fragmented Visibility: VPNs provide point-to-point connectivity, making it challenging for security teams to maintain network visibility.
- No Integrated Security: Additional security solutions are required behind VPNs to identify and block malicious content.
- Inefficient Routing: Hub-and-spoke model detours traffic through a centralized security stack, which may not be optimal.
- Poor Scalability: VPNs scale poorly, creating a complex network infrastructure with the growing number of connections.
- Endpoint Vulnerabilities: Compromised endpoints can pose a threat as they have full access to VPN resources.
In conclusion, while VPNs offer secure connectivity, they come with limitations that organizations need to consider, prompting the exploration of alternative secure remote access solutions.
