What is a VPN?

A VPN, or virtual private network, is an encrypted connection built across the internet between two points, often described as a tunnel. The name is used for two different products: one that connects staff or sites to an office network, and one that is sold to the public for privacy.

The business VPN

A business VPN joins something outside the office to the network inside it. It comes in two forms.

• Remote access. An encrypted tunnel between one person’s computer and a VPN device at the office. Someone working from home can then open the file server or the accounts system as if they were at their desk.
• Site to site. An encrypted tunnel between two VPN devices, such as the routers at two offices. Everyone at both sites shares one network without doing anything.

What it does: it protects data while it crosses networks you do not control, and it means internal systems only have to accept connections from devices that have signed in to the VPN, instead of from the whole internet.

What it does not do: it does not make the remote computer safe, and it does not check who is holding the password. The VPN device also faces the internet, and the Australian Signals Directorate names VPN gateways among the edge devices that attackers commonly go after. A VPN that is misconfigured or behind on updates becomes a way in.

The consumer VPN

A consumer VPN is a subscription service with an app. The app sends your internet traffic through the provider’s servers before it reaches the websites you visit. The eSafety Commissioner describes what that gets you: it hides your location from websites, makes it harder for advertisers to track you, can make public Wi-Fi safer to use, and lets you reach Australian sites that are blocked from overseas.

eSafety also warns that VPN advertising makes extreme claims, and sets out the limits:

• Your internet provider can still see that you are using a VPN, and police and government agencies can still see what you do online.
• It is not antivirus. You can still be tricked into clicking a bad link or giving away a password.
• On public Wi-Fi, eSafety still advises against banking or entering passwords, even with a VPN on.
• You are relying on the VPN company’s promise not to record or sell what you do. Free services may show ads, and some sell browsing data.

A consumer VPN has nothing to do with your office network. It will not let staff reach the file server.

Which one does a business need?

If staff need to reach systems that live in the office, such as a file server or an older application, a business VPN is the usual answer. If everything the business uses is a cloud service that staff sign in to through a browser, there may be nothing in the office to connect to. The UK National Cyber Security Centre says plainly that an organisation with no use for what a VPN provides has no need to run one, and notes that VPNs take effort to set up and maintain.

If you run a business VPN

• Require multi-factor authentication for every VPN login.
• Install security updates on the VPN device as soon as they are released.
• Remove accounts for people who have left.
• Have someone review the settings and the logs.

Our network services team sets up and maintains remote access for offices. If remote logins are the worry, start with Should your business make MFA mandatory?.