As an enterprise mobility expert, I am frequently asked how Virtual Private Networks (VPNs) can protect users from various cyber threats. To answer this question, it is helpful to understand what a VPN is, how it works, and how they are used.
What Is A VPN?
VPN is a technology that uses authentication and encryption to create a secure, private network connection between two endpoints over an untrusted network such as the public Internet or an unknown wireless (Wi-Fi) network. They are used to protect data communication between two devices, preventing anyone else from “listening” to the conversation.
VPN Types
There are two main types of VPN connections: Consumer VPN and Enterprise VPN. Each solution provides the same type of protection but have different applications.
Consumer VPN
Consumer VPNs are used by individuals and are commonly provided as a service. NordVPN, ExpressVPN, and ProtonVPN are some of the most popular solutions on the market today. These VPNs are most commonly used to provide a layer of transparency for the users Internet activity. Consumer VPNs are not always used for nefarious purposes, although that is not uncommon. Consumer VPNs are often employed by privacy-conscious users who wish to remain anonymous on the Internet. This can be helpful to avoid disclosing sensitive information, but also to mask the user’s true location. Consumer VPNs are often essential in non-democratic parts of the world.
Enterprise VPN
Enterprise VPNs are deployed by organizations to allow their employees to work remotely. When a user with a company-issued device (laptop, tablet, phone, etc.) is out of the office, they will still be able to access on-premises data, information, and applications. An enterprise VPN also allows administrators to manage and control company owned devices wherever they are located.
Cyber Threats
Using a VPN can protect the user from cyber threats involving an attacker attempting to snoop on conversations between two endpoints. For example, without a VPN it might be possible for someone to capture your communication and steal sensitive information such as medical records, banking details, etc. VPNs provide essential protection for untrusted and/or unencrypted Wi-Fi networks. It should be noted that this risk is diminishing every day as many online services are already encrypted in some form.
VPN Risks
It is important to understand that using a VPN is not a panacea. There are also inherent risks that come with using a VPN.
Consumer VPN Risks
A consumer VPN may prevent your Internet Service Provider (ISP) from monitoring your browsing habits, or it may prevent attackers from stealing your banking information while browsing the Internet at the coffee shop, but remember that anything you do over the VPN is in full view of the VPN provider. Choose your VPN service wisely! If you are not careful you could unwittingly be divulging your deepest secrets to a third-party and paying them for it as well.
Enterprise VPN Risks
An enterprise VPN can allow field-based workers access to on-premises resources to ensure the highest level of productivity, but attackers can also use the VPN to gain access to steal data or plant ransomware. If an attacker can steal a legitimate user’s credentials they could connect to the VPN and cause a lot of problems. Enterprise VPNs should be configured to use strong authentication (certificates) or multifactor authentication (MFA) to mitigate this risk.
