As the world is moving ahead, leaving the scars of Covid-19 pandemic behind, the work from home culture is still sustaining and will most likely become a permanent arrangement. While there are many benefits to this new work from home or hybrid workstyle, it poses new challenges for corporate IT and information security teams that provide support to remote employees. One of the biggest is cyber threats compromising remote workers, which in turn exposes the company’s sensitive data to malicious acts.
Companies have responded to these cyberthreats by increasing their reliance on VPNs to offer secure access to their remote workers.

‍

Are VPNs even safe for remote access in a hybrid work environment?

VPNs are designed to keep critical company data safe from prying eyes while also allowing for a secure connection to the enterprise applications. However, today companies are adopting cloud infrastructure. Applications hosted on public clouds or SaaS applications can’t be protected by VPNs.

Besides being costly to adopt and operate, VPNs may potentially increase security threats. The National Security Agency even issued a recent warning that the increased use of VPNs for remote work has drawn the attention of malicious actors, increasing the risk of cyberthreats if VPNs are not adequately secured.

As per FBI internet crime report 2021, 57% cyberattacks occurred on remote working devices while using VPN. In another incident on October 12, 2020, a new vulnerability affecting over 800,000 internet-connected SonicWall VPN devices was identified. It was associated with a security issue on the SonicWall VPN site that may have caused the device to crash and enabled easy remote code execution.

These vulnerabilities brought to light that VPN flaws are problematic and provide entry points into critical networks, making it difficult for system administrators to detect a breach. After breaching a VPN, hackers can spend months mapping out a target network before installing ransomware, making extortion demands, compromising sensitive data, and denting business reputation.

‍

How does a VPN work?

Enterprise Virtual Private Network (VPN) provides a secure tunnel to establish communication between remote users and corporate network. All the traffic coming through a VPN tunnel is encrypted before users can access all the resources and data.

‍

‍

Traditionally, enterprise VPN has been used to connect company's remote locations to central computing resources in the site-to-site model. Now, connecting remote workers to corporate resources is an emerging use case.

‍

The vulnerabilities encircling VPN

When employing a VPN for remote workers, enterprises take a castle-and-moat approach to security. It is based on a network paradigm that restricts users from outside the network from accessing data inside the network but allows users inside to do so. As a result, once a VPN connection is established, a user practically has unrestricted access to the remainder of the network. A non-admin user can also have unauthorized access to critical data. This model of VPN also raises the risk of malware infestation and data breaches.

Some of the vulnerabilities surrounding VPN for remote workers include:

1. VPN users have a lot of power: VPN does not allow users to gain granular access to certain resources. Users connect via shared IPs, which can expose unauthorized resources.
2. Simple authentication: Stolen credentials can easily be exploited if no additional measures like MFA are in place.
3. Malware via insecure endpoints: Devices are not checked for security posture, allowing malware to spread.
4. Incomplete security stack: Remote users don’t get the full office security stack, leading to inefficiency and added complexity.
5. Single point of failure: VPN gateways can be crippled by DoS attacks, halting remote work.
6. Unpatched vulnerabilities: Hackers exploit outdated VPNs to gain entry.
7. Increased complexity: Multiple VPNs multiply management overhead and risks.
8. Limited admin visibility: IT teams have little insight into VPN usage, delaying breach detection.
9. Split tunneling risks: Hackers can exploit shared traffic paths to compromise both internet and corporate network access.

‍

A fool-proof alternative to VPN for remote workers: ZTNA

Companies need to implement additional security point-solutions to add detailed security controls to remote access VPNs, but doing so adds cost and complexity while leaving a lot of room for misconfiguration and human error. Therefore, VPNs are no longer the sole or even the best option for workplace remote access.

This is where the new model of Zero Trust Security (ZTNA) addresses the pain points left untouched by VPN.

‍

‍

According to Gartner's Market Guide for Zero Trust Network Access (ZTNA), by the end of 2023, 60% of organizations will abandon VPN in favor of ZTNA owing to the shifting workstyle. The primary benefit of ZTNA is the granular control it provides over who gains and retains network access, to which specific resources, and from which end user devices.

Zaperon's foolproof security strategy based on the Zero Trust Model addresses the threats encompassing remote workstyle. Our continuous risk analysis ensures that no breach penetrates the employee network, that remote connectivity is faster, and that remote access is secure, all while preventing potential assaults. Furthermore, our strategy enforces strong identity and access control and PKI-based passwordless authentication to eliminate risks associated with passwords.