Virtual Private Network

Description

A VPN does not provide anonymity; it moves the point of trust from the network you are on into the hands of the VPN provider — or your own VPN server. Commercial VPN services protect traffic on untrusted networks; a corporate VPN opens a door into the company network — and that is where the similarity ends.

That door has become a favorite target. Perimeter VPN appliances are actively attacked — stolen accounts and unpatched devices are routinely the first step in serious incidents. A VPN account without additional identity verification, and an appliance without patches, are not a defense but exposed surface.

A VPN protects the path to the network, not what happens at the destination: a compromised laptop carries the problem through the tunnel straight into the corporate network.

What people often say

• We have a VPN — remote work is taken care of.
• A VPN makes me anonymous and protects me from malware.

Covers / does not cover

Covers

• Controlled remote access to internal resources
• Protecting traffic on untrusted networks (public Wi-Fi)
• Encrypting traffic between the device and the network
• Separating business access from the open internet

Does not cover

• A compromised device entering legitimately through the tunnel
• Theft of VPN credentials (without MFA the account is just another password)
• Vulnerabilities of the VPN appliance itself
• What the user does once traffic leaves the tunnel