All articles
Security EngineeringInfrastructure & Network Security
Browse Knowledge Base

VPN & Remote Access Security - ZTNA & Device Posture

8 min read

Master VPN and remote access security: VPN technologies, ZTNA, device posture validation, split tunneling trade-offs, and secure remote work.

VPN and remote access security enables secure connectivity for remote workers while minimizing attack surface. Security engineers evolve from network-centric VPNs to identity-centric and application-centric Zero Trust Network Access (ZTNA) while hardening legacy tunnels.

Remote access is high-leverage for attackers. Compromised VPN credentials provide direct network access—require strong authentication, device posture validation, and continuous monitoring.

Well-designed remote access balances security and user experience, extending corporate network to untrusted locations per network security through advanced threat detection.

VPN Technologies

TLS-Based VPNs

OpenVPN provides open-source TLS-based VPN. OpenVPN is widely supported and flexible.

Cisco AnyConnect provides enterprise TLS VPN per transport security. AnyConnect integrates with Cisco infrastructure.

TLS-based VPNs operate at application layer. Application layer enables easier firewall traversal.

TLS-based VPNs should use modern cipher suites through cryptographic hashes. Modern crypto ensures security.

Certificate-based authentication should be used per key management. Certificates provide strong authentication.

IPsec VPNs

IPsec operates at network layer per network security. Network layer provides transparent connectivity.

IKEv2 provides modern IPsec key exchange through key management. IKEv2 supports mobility and reconnection.

IPsec should use strong encryption (AES-256) and authentication (SHA-256 or better) per cryptographic hashes. Strong crypto ensures security.

IPsec is well-supported on mobile devices through mobile security. Native support improves user experience.

WireGuard

WireGuard provides modern, lightweight VPN per transport security. WireGuard has smaller codebase than alternatives.

WireGuard uses modern cryptography through cryptographic hashes. Modern crypto provides security.

WireGuard provides better performance than traditional VPNs through performance engineering. Performance improves user experience.

WireGuard is increasingly supported. Support is growing rapidly.

Technology Selection

Technology selection should consider security, performance, and compatibility per security tooling strategy. Balance depends on requirements.

Modern crypto suites should be preferred through cryptographic hashes. Modern crypto provides better security.

Legacy protocols (PPTP, L2TP) should be avoided per infrastructure hardening. Legacy protocols have known vulnerabilities.

Authentication and Authorisation

Strong Authentication

Multi-factor authentication (MFA) should be required per zero trust architecture. MFA prevents credential-based attacks.

Device certificates provide device authentication through key management. Certificates prove device identity.

Short-lived sessions limit exposure per session management. Sessions should expire after inactivity.

Continuous authentication validates ongoing access through zero trust. Continuous validation detects compromise.

Device Posture Checks

Device posture validation ensures devices meet security requirements per endpoint security. Posture checks prevent compromised devices.

Operating system version should be validated through infrastructure hardening. Current OS reduces vulnerabilities.

Antivirus status should be checked per endpoint security. Antivirus provides baseline protection.

Disk encryption should be verified through data encryption at rest. Encryption protects data at rest.

Firewall status should be validated per network security. Firewall provides network protection.

Posture checks should be continuous through zero trust. Continuous checks detect changes.

Authorisation Policies

Access should be based on identity and context per zero trust. Context includes device, location, and time.

Least privilege should be enforced through secrets management. Minimal access reduces risk.

Role-based access control (RBAC) provides coarse-grained control per zero trust architecture. RBAC suits most organizations.

Attribute-based access control (ABAC) provides fine-grained control through zero trust architecture. ABAC enables context-aware access.

Zero Trust Network Access (ZTNA)

ZTNA Architecture

ZTNA brokers sit in front of applications. Brokers enforce policy before granting access.

Per-application access provides granular control through API security. Per-app access is more secure than network access.

Policy is enforced at Policy Enforcement Point (PEP) per zero trust. PEP validates every request.

ZTNA eliminates network-level trust through network security. Elimination improves security.

ZTNA vs Traditional VPN

Traditional VPN provides network-level access per network security. Network access is broad.

ZTNA provides application-level access through zero trust. Application access is narrow.

Traditional VPN trusts network after authentication. Trust is implicit.

ZTNA validates every request per zero trust. Validation is continuous.

ZTNA should replace traditional VPN where possible through security maturity. ZTNA provides better security.

Identity-Aware Proxies

Identity-aware proxies authenticate users before granting application access. Proxies provide application-level control.

Proxies integrate with identity providers per API security. Integration enables single sign-on.

Proxies can enforce additional policies. Policies include device posture and location.

Google BeyondCorp and similar solutions provide identity-aware proxy. Solutions enable ZTNA.

Network Architecture

Split Tunneling

Split tunneling routes some traffic through VPN and some directly per network security. Split tunneling improves performance.

Split tunneling should be allowed with strict egress policies through data loss prevention. Policies prevent data exfiltration.

Corporate resources should route through VPN. VPN protects corporate traffic.

Internet traffic can route directly with DNS filtering per network security. Direct routing improves performance.

Full-tunnel should be used for high-risk roles through secrets management. Full-tunnel provides maximum control.

Full Tunneling

Full tunneling routes all traffic through VPN per network security. Full tunneling provides complete visibility.

Full tunneling enables comprehensive security controls through SIEM. Controls include DLP and threat detection.

Full tunneling can impact performance. Performance impact should be considered.

Full tunneling should be used for privileged access. Privileged access requires maximum security.

Egress Control

Egress proxying controls outbound traffic from remote clients per network security. Proxying enables filtering.

DNS control prevents DNS-based exfiltration through advanced threat detection. DNS filtering blocks malicious domains.

Cloud metadata endpoints should be blocked. Metadata endpoints expose sensitive information.

Egress policies should be enforced per data loss prevention. Enforcement prevents data loss.

Operational Security

Gateway Hardening

VPN gateways should be patched rapidly per vulnerability management. Gateways are high-value targets.

Management interfaces should be restricted through infrastructure hardening. Restriction prevents unauthorized access.

Rate limiting prevents brute force attacks per API security. Rate limiting protects authentication.

DoS protections prevent denial of service through resilience engineering. Protections ensure availability.

Gateway configuration should be hardened per infrastructure hardening. Hardening reduces attack surface.

Monitoring and Detection

Authentication failures should be monitored through SIEM. Failures indicate attacks.

Geographic anomalies should be detected per advanced threat detection. Anomalies indicate compromise.

Impossible travel should be flagged through threat detection. Impossible travel indicates credential theft.

Device health attestation should be monitored per endpoint security. Attestation shows device posture.

Connection patterns should be analyzed through threat hunting. Patterns identify anomalies.

Incident Response

Compromised accounts should be disabled immediately per incident response. Immediate action limits damage.

Compromised devices should be isolated through security automation. Isolation prevents lateral movement.

Incident response playbooks should be prepared. Playbooks enable rapid response.

Post-incident review should identify improvements per resilience engineering. Review drives improvement.

Migration from VPN to ZTNA

Application Inventory

Inventory all applications accessed remotely per attack surface management. Inventory identifies migration scope.

Categorize applications by risk and usage. Categorization enables prioritization.

Identify application dependencies through threat modeling. Dependencies affect migration order.

Migration Strategy

Move to identity-aware proxies incrementally per security maturity. Incremental migration reduces risk.

Start with low-risk applications. Low-risk applications enable learning.

Deprecate broad flat VPNs gradually through security governance. Gradual deprecation maintains service.

Educate users on new access methods per stakeholder communication. Education ensures adoption.

Measure migration progress through security metrics. Measurement shows completion.

User Education

Users need training on new access methods per building security teams. Training ensures smooth transition.

Communication should be clear and timely through stakeholder communication. Communication prevents confusion.

Support should be available during migration. Support addresses issues.

Feedback should be collected and addressed. Feedback drives improvement.

Remote Work Security Patterns

Secure Remote Workspace

Corporate-managed devices should be preferred per endpoint security. Managed devices enable control.

Bring-your-own-device (BYOD) requires containerization through mobile security. Containerization isolates corporate data.

Virtual desktop infrastructure (VDI) provides secure remote desktop per cloud security. VDI centralizes data.

Cloud-based workspaces enable secure access through cloud security. Cloud workspaces reduce on-premise dependency.

Network Security

Home networks are untrusted per zero trust. Untrusted networks require protection.

VPN or ZTNA should be required. Protection ensures security.

Public WiFi requires additional protection through transport security. Public WiFi is high-risk.

Network segmentation should be encouraged. Segmentation limits exposure.

Data Protection

Data loss prevention (DLP) should be enforced per data loss prevention. DLP prevents data exfiltration.

Encryption should be required for data at rest and in transit through key management. Encryption protects data.

Cloud storage should be controlled per cloud compliance. Control prevents shadow IT.

Data loss prevention should drive protection. Classification enables appropriate controls.

Conclusion

VPN and remote access security enables secure connectivity for remote workers through appropriate technologies, strong authentication, Zero Trust Network Access, and operational security. Security engineers evolve from network-centric VPNs to identity-centric and application-centric ZTNA.

Success requires modern VPN technologies with strong crypto, strong authentication with MFA and device posture, ZTNA architecture with per-app access, split or full tunneling based on risk, operational security with monitoring and rapid patching, and migration strategy from VPN to ZTNA. Organizations that invest in remote access security enable secure remote work while minimizing attack surface.

Related Articles

References

Previous

TTPs - Tactics, Techniques, and Procedures

Next

Vulnerability Management: CVSS vs EPSS Prioritization & CISA KEV Guide