What is a VPN?

A Virtual Private Network (VPN) is an extension of a private network across a public or shared network that allows users to send and receive sensitive data as securely as if the connection was completely within a company’s private network. When using a VPN, applications also gain the functionality, security and management benefits of the private network.

VPNs are frequently encrypted to provide maximum security in order to prevent hackers and other unauthorized parties from “observing” traffic and stealing data. VPNs are most commonly used by workers who are operating remotely, providing low-cost, secure access in place of private networks.

How does a VPN Work?

A VPN involves the establishment of a virtual point-to-point connection using dedicated circuits or secure tunneling protocols over a shared or public network. VPNs authenticate remote users and assign them internal addresses (via NAT) so that they can be tracked. With site-to-site VPNs, all addresses are internally routed as one network.

VPNs that are used through a public network offer benefits similar to a wide area network (WAN).

What are the different types of VPN?

While there are numerous types of VPNs, the following are three of the more prominent versions:

  • Remote access VPN - A remote access VPN securely connects devices outside the physical office infrastructure, such as laptops, tablets, and smartphones, to a company’s private network. Security conducted on endpoints enable a safe connection with risk of compromising sensitive data.
  • Site-to-site VPN – Site-to-site VPNs are a low-cost replacement for private networks that run encrypted tunnels over the internet. This type of VPN is often used to connect branch offices with a central office location why physical distance makes it impossible to have a direct network connection between offices.
  •  SSL VPN – SSL VPN enable clientless remote access, allowing any device with a browser to leverage the built-in encryption capabilities for secure remote access. Users are authenticated and tracked for security purposes.

How are VPNs used for remote workers?

VPNs are particularly useful for remote workers who need to connect to business networks, colleagues and customers securely. The authentication and encryption assure only authorized employees can access the network and the encryption prevents unauthorized actors from accessing information as it passes through the internet. For example, employees working from home, who are accessing sensitive data, such as source code, HR records, financial information, etc., can do so securely, as if they were on a company’s private internal network.

How can you protect a VPN?

While VPNs by their very nature are a more secure means of connecting to vital company servers through public networks, vulnerabilities remain. Hackers and cyber criminals are always looking for ways to penetrate protections around VPN servers in order to gain access to the wealth of data and information that lies within a business. 

Because VPN servers were not traditionally viewed as a vital connection, frequently used primarily by a small number of business travelers and people looking to access company resources during off hours, applying the latest security patches simply wasn’t seen as a top priority. But as the workforce has largely shifted to remote access, with traffic spiking, the need for IT security professionals to stay on top of security patches to VPN servers has become urgent.

In addition to VPN servers, security teams should also patch all firewalls and routers. It would also be prudent for IT to regularly monitor the network for any indications of unauthorized activity that could indicate a breach has occurred.  At the same time, monitoring VPN usage, looking at important parameters such as which users are logging in, where are they logging in from, and how long are they on the network, can provide insight in suspicious VPN usage patterns that might indicate an attack or penetration by hackers.

What is the history of VPNs?

The first iteration of the modern VPN was created in 1993 by a team from Columbia University and AT&T Bell Labs. This was known as the Software IP encryption protocol or swIPe. The next year, Wei Xu was responsible for introducing the IPSec network, which is an internet security protocol that authenticates and encrypts data packets shared across the web.