Endpoint Security with VPN: Protecting Remote Devices

Key Takeaways

• Traditional VPNs have been essential for enabling remote access to corporate networks, but they struggle to deliver secure, fast connectivity for modern business operations.
• With the need to backhaul data through centralized infrastructure and only providing network-level access, traditional VPNs present both security and performance limitations.
• Cloud VPNs provide significant benefits by eliminating hardware limitations, improving scalability, and reducing latency for remote workers.
• ZTNA offers an entirely new endpoint security approach that benefits cloud-first organizations with hybrid workforces.
• By eliminating implicit trust, continuously authenticating users, enforcing least-privilege access, and enabling direct cloud access, ZTNA is a superior remote access model for modern enterprises.

Limitations of the Traditional VPN

Traditional VPNs are based on a centralized IT model that assumes all devices, users, and traffic must funnel through the corporate network. When businesses primarily deployed their applications on fixed, on-premises infrastructure, security teams could easily define a static perimeter around the internal network. A firewall then protects this perimeter, and endpoint VPNs tunnel inside to connect remote devices to internal corporate resources. This enables safe off-site access with all traffic subject to the same perimeter security controls.

However, traditional endpoint VPN solutions fall short of meeting the demands of modern businesses. In particular, hybrid workforces with many users connecting remotely and cloud-based applications deployed outside the corporate network. These factors make it impossible to define a static perimeter around an organization’s IT infrastructure.

Trying to enforce perimeter-based security models and traditional VPNs on cloud-first business operations creates significant security, networking, and operational challenges. Limitations include:

• Broad Network-Level Access: Traditional VPNs are overly permissive, implementing network-level access controls rather than providing more granular controls at the application layer. Endpoint security with VPNs authenticates a user at the network perimeter. The user is then granted broad network access, increasing an organization’s attack surface and enabling lateral movement between enterprise systems.

• VPN Security Issues: Broad network access limits visibility into application-level user activity, reducing the IT team’s ability to identify suspicious behavior and potential threats. There have also been multiple documented vulnerabilities from large VPN vendors, leading to network breaches.

• Unnecessary Backhauling: Traditional VPNs route traffic back to the centralized corporate network to enforce perimeter security controls. This adds latency, slowing access and reducing productivity for remote workers. VPN backhauling even occurs when neither the user nor the application is located inside the internal network.

• Capacity Bottlenecks: As the number of remote workers increases, traditional VPNs often struggle to provide the bandwidth for all users to tunnel into the corporate network. This limits access, reducing transfer speeds and impacting user experience and productivity, particularly during peak work hours.

• Scalability: As a hardware solution implemented at each branch location, traditional VPNs offer limited scalability as traffic demand increases. Businesses need to upgrade their hardware to upgrade network capacity or expand to new locations. This reduces business agility and increases capital expenditure.

• Management Complexity: Maintaining hardware across multiple locations complicates business operations, making it difficult to deliver consistent security policies and ensure compliance for every user. Managing endpoint security with VPNs and protecting remote devices is also challenging, given the diversity of devices in use, including unmanaged devices through the implementation of Bring Your Own Device (BYOD) policies.

To ensure security and fast connectivity for hybrid workers accessing cloud-based applications, organizations need to upgrade from endpoint VPNs. A popular option that does not require overhauling your network architecture is switching to a cloud VPN.

ZTNA: Taking Protection One Step Further

VPNs are designed for open internal networks. Once users and traffic pass perimeter security checks, they are deemed trusted and granted broad network access. This security model inherently adds unnecessary risk, and given the challenges of applying perimeter-based security controls to distributed applications and workforces, it makes sense to consider a new, identity-based approach that better meets the needs of modern enterprise.

ZTNA eliminates implicit trust based on location, assuming that all users and devices are unsafe and must continually authenticate themselves to access each application or network area. It typically enforces enhanced authentication methods, including multi-factor authentication, and takes into account contextual information such as the users’ typical behavior and the device’s security status.

It simultaneously minimizes access to only the resources each user requires to complete their job. By following the principle of least privilege, ZTNA significantly reduces network and endpoint security attack surfaces, reducing the risk of initial breaches and eliminating lateral movement between business systems.

By continually authenticating users and devices, ZTNA provides granular application-level access rather than enabling broad network access. This offers a range of security benefits, including significantly reducing the impact of a compromised account or device and providing enhanced visibility into network activity. Administrators can monitor access requests for each application to better understand network activity, user behaviors, and potential threats.

ZTNA and VPNs provide entirely different approaches to endpoint security and protecting remote devices. A summary of the key differentiators between the two technologies is shown below:

• • User Authentication: With ZTNA, no user or device is trusted by default, regardless of their location, inside or outside the corporate network. It requires continuous authentication and contextual checks before granting access to specific resources. VPNs generally authenticate users once before granting access to the entire corporate network. After passing an authentication check at the network perimeter, the user has broad access to all the resources.

• Visibility and Security: ZTNA provides granular visibility into user activity and network traffic, enabling enterprises to monitor and analyze every request in real-time. Traditional VPNs typically route all traffic through a central network gateway, providing a single point of visibility.

• • Performance and User Experience: By enabling direct access to cloud applications without backhauling data to the internal network, ZTNA delivers faster performance and a better user experience for remote workers. VPNs introduce latency by routing all traffic through centralized infrastructure and experience bottlenecks when handling many remote users.

• Scalability and Management: As a cloud-based solution that doesn’t rely on dedicated hardware, ZTNA can seamlessly scale with demand. Management is also simplified, with ZTNA often deployed as part of a comprehensive Secure Access Service Edge (SASE) solution. Scaling a traditional VPN often requires additional hardware, and configuring this hardware complicates network management.

• Cost and ROI: With reduced overheads and no hardware costs, ZTNA typically offers lower costs and better ROI. Enhanced security, network performance, and operations also lead to financial benefits. In contrast, VPNs typically incur ongoing hardware, maintenance, and licensing costs. Furthermore, VPNs may expose organizations to costly security breaches, resulting in potential data loss, reputational damage, or regulatory fines.
  

  	ZTNA	Traditional VPN
  User Authentication	Continuous authentication	Single authentication
  Visibility and Security	Granular visibility at the application level	Limited visibility based on network-level access
  Performance	Low-latency connectivity to cloud applications	Traffic backhauled through centralized networks
  Scalability	Highly scalable, cloud-based solution	Hardware-based solution with time-consuming and costly upgrades
  Management	Simplified, centralized management	Manual configuration, more complex management
  Cost & ROI	Lower overhead, as well as savings from improved security	Ongoing hardware and maintenance costs reduce ROI