VPN

A VPN, or virtual private network, is a technology that establishes an encrypted connection between two points across a public network such as the internet. It creates a private tunnel that protects the confidentiality and the integrity of the data travelling through it, so that anyone intercepting the traffic on the way cannot read it.

The tunnel is raised by encapsulating the data in encrypted packets: once the connection has been negotiated, everything that passes between the two ends travels encrypted. The usual protocols are IPsec, SSL/TLS and OpenVPN, and each has its own characteristics.

The two uses people look for are different, and they are worth keeping apart. One is corporate remote access: reaching the office servers, folders and applications from home as if you were sitting inside. The other is privacy on the internet: encrypting the traffic and hiding the real IP address, which is what people are after on a public Wi-Fi network. What follows deals with the first, which is the one that shows up in an audit.

A VPN builds an encrypted tunnel between a remote device and a concentrator on the corporate edge, and once the tunnel is up the device is treated as if it were on the internal network. That is its defining property and its weakness: access is granted at the network layer, so a connected client can typically reach far more than the one application it needed. The concentrator is a device exposed to the whole internet, published so that any user can reach it to authenticate. Its role has not disappeared, but for user access it is being displaced by ZTNA, which grants access to a named application after checking identity and device posture, usually as part of an SSE or SASE platform.

Two operational facts make VPNs a favourite target. First, the concentrator is an internet-facing appliance, and appliances of this kind have been the subject of mass exploitation: a single unpatched flaw in the device gives an attacker a foothold on the edge of the network. Second, once inside the tunnel the attacker inherits flat network access, so a compromised or stolen credential does not reach one app, it reaches the internal network. From the offensive side, a VPN turns a phished credential into internal presence in one step, which is exactly the lateral reach that a per-application broker removes.

We assess remote access as an exposed service and as an access model. On the service we check the concentrator’s patch level, its exposed management, and whether multi-factor authentication is enforced at the tunnel. On the model we test what a connected client can actually reach, because broad network access is itself a finding. Where a zero trust approach is intended, we check that access is genuinely per-application and not a VPN relabelled. This is part of how we test your remote access exposure.