Secure remote access solutions have become a priority for organizations that have suddenly transitioned to mostly or wholly remote workforces. Virtual private networks (VPNs) are a popular solution to this challenge but are not the only option available.
Software defined perimeter (SDP) solutions provide an alternative for organizations seeking to securely support their remote workers.
How Virtual Private Networks Work?
VPNs are designed to be a point-to-point secure remote access solution. A VPN endpoint on the enterprise network is connected via an encrypted tunnel to client software on a remote worker’s computer or another VPN endpoint on a remote site’s network.
The primary purpose of the VPN is to provide confidentiality for the traffic flowing over this connection. All traffic is encrypted when passing between the VPN endpoints and software, making it impossible for an attacker to eavesdrop on the traffic or to modify it without detection.
A VPN connection or “tunnel” is designed to emulate a direct connection between the two points. The VPN system does not provide any security inspection of the traffic that is passing over it or apply access controls to this traffic. The remote employee or site is provided with full access to the enterprise network unless additional security solutions are put in place to restrict this.
Inside a Software-Defined Perimeter Solution
Like VPNs, SDP solutions are designed to provide secure remote access to an organization’s network and resources. This includes providing encrypted connections that protect against eavesdropping or modification of traffic in transit.
However. SDP solutions implement these connections differently than VPNs. Instead of a single “tunnel” that carries all traffic between the two points, SDP creates microconnections. These microconnections provide access to a certain user on a specific device to a particular resource.
These microconnections are established by an SDP controller. The SDP controller can collect information about the remote user, device, and requested resource. and use this data when making a decision about whether or not to allow a connection attempt. Based upon predefined role-based access control rules and a calculation of the risk posed by a particular request, the SDP solution either approves or denies the request.
Comparing SDP and VPNs
Both VPNs and SDP solutions are designed to provide secure remote access to an enterprise network. This remote access enables an organization to support remote workers or satellite sites without concerns about whether or not traffic is being inspected or modified in transit.
However, these two types of solutions take very different approaches to secure remote access. Some of the primary differences between VPNs and SDP include:
- Tunnel vs. Microconnections: VPN solutions commonly create “tunnels”, where all traffic between the two endpoints is sent over the same encrypted link. In contrast, SDP uses micro connections that provide explicit access to a particular resource based upon the details of the request (user, device, etc.).
- Contextual Awareness: VPNs are designed to provide an encrypted tunnel with little to no visibility into the traffic flowing over it. SDP, on the other hand, collects information about the user, their device, and the resources to which they are requesting access to make informed decisions about whether or not that request is legitimate and the risk that it poses to the organization.
- Access Controls: VPN solutions are designed to provide a remote user with secure access to the enterprise network. A VPN user has full access to the network and its resources unless other access management solutions are in place. SDP, on the other hand, is built using zero trust principles and limits access based upon role-based access controls.
- Cloud Support: Organizations are increasingly moving infrastructure to the cloud, making cloud support essential. While VPNs can support cloud-based infrastructure, organizations often route this traffic through the enterprise network first to apply access controls and security inspection of traffic. SDP, on the other hand, can implement these access controls natively in the cloud, providing more efficient network routing.
Selecting a Secure Remote Access Solution
VPN solutions have been around for decades, and organizations’ network and security needs have evolved in that time. When VPNs were developed, most of an organization’s assets and workers were located on-site, making secure remote access solutions a relatively small part of an organization’s IT infrastructure.
Now, secure remote access is vital to enterprises supporting remote workforces and cloud-based infrastructure. As telework becomes increasingly common, investing in a secure remote access solution designed for the modern enterprise, such as SDP, is a critical part of an organization’s IT strategy.
SDP solutions can be deployed as standalone solutions; however, this is not the only option. Secure Access Service Edge (SASE) solutions commonly integrate SDP functionality alongside a full security stack. This provides companies with a scalable, cloud-native solution for secure remote access that is designed to support modern cloud-based enterprises with remote workforces.
