SDP vs VPN: the shortcomings of VPN technology
VPNs were not designed to secure hybrid IT infrastructure or a hybrid workforce, and are well past their prime. In fact, several US government agencies, including the National Security Agency (NSA), have issued warnings about VPN shortcomings. Then there are the administrative “headaches”, because VPNs can only scale with more hardware (physical or virtual), which means a major investment of capital and time.
Additional VPN shortcomings include:
- Exposed ports: threat actors can use common hacking tools to easily find and query VPNs to discover the manufacturer and version
- Over-privileged access: VPNs depend on overly complex rules to prevent lateral movement
- Inability to scale dynamically: VPNs must be architected to accommodate a certain volume of remote users and cannot scale dynamically to handle user fluctuations
- Limited throughput: a typical VPN maxes out below 1 Gbps, which adds extra cost and complexity
- Centralized architecture: users accessing VPNs are routed to backend destinations over a wide area network (WAN) … which adds latency and performance issues, frustrates users and creates complicated routing dependencies.
Software-defined perimeter (SDP) is a term used interchangeably with Zero Trust network access (ZTNA). Not only does SDP simplify and strengthen remote access security, it can also be applied to all of the enterprise’s secure access use cases, including all user-to-resource and resource-to-resource connections.
SDP vs VPN: Introduction
Organizations use a VPN (virtual private network) to connect remote employees to the company’s internal private network through an encrypted “tunnel” between employees’ devices and the network. With a VPN, remote users can access resources as if they were in the office. However, VPN is built on an outdated security model of “connect first, authenticate second”. This requires open ports listening for incoming connections, which can easily be found during an attacker’s reconnaissance phase. VPNs rely on poor authentication measures such as passwords that are often weak, reused and easily exploited through social engineering or brute force, or available for purchase. In addition, segmentation with a VPN is excessively complex and often leads to open, over-privileged access that is conducive to unauthorized lateral movement. Finally, VPN technology is hardware-bound and static, making it a siloed headache in dynamic, fast-changing IT environments.
SDP decentralizes security controls and moves them from the network layer to the application layer, dynamically creating individual connections between users and the resources they access. The software-defined perimeter and ZTNA (Zero Trust Network Access) are built on a proven and more secure Zero Trust model of “authenticate first, connect second”, which creates individualized perimeters for each user, allowing more precise access control. The software-defined architecture and API-driven approach open up major potential for automation and scalability in today’s dynamic IT environments.
SDP vs VPN: How does SDP work?
First, let’s get familiar with the basic components of the software-defined perimeter (SDP) architecture. It is important to note that the best SDP solutions can be deployed via a cloud-based delivery model or self-hosted, depending on the organization’s preferences.
- Controllers: the controller is the brain of the system. It defines security policies by verifying trust using identity, context and risk data, and then grants the appropriate entitlements.
- Gateways: This is where the controller’s policies are enforced; gateways sit wherever resources need to be protected.
- Clients: clients are what end users interact with to first establish trust through the controller, and then connect to their trusted resources with the appropriate entitlements.
It is important to note that the controller and gateway are completely hidden from prying eyes using a technology called single packet authorization (SPA). This means there are no visible ports until a user has been authenticated, approved and granted an entitlement. Using SPA, the controller authenticates a user or device with an identity provider to validate entitlements and further checks the context surrounding the request, using risk scoring as a criterion to establish, limit or revoke access. Once trust is established, and using SPA, the controller provides a live entitlement to the client, then to the gateway, to access the right resources. This is called a live entitlement because if the context or risk changes, entitlements can adjust in real time. The gateway then validates that the assigned token has not been tampered with and generates a segment of one, meaning the user/device has access to the specific resources it has been granted approved access to. Everything else remains invisible.
SDP vs VPN: Zero Trust security and its relationship with SDP
In recent years, Zero Trust security has become a popular approach to data security, for good reason. Traditional security solutions such as VPNs assume that all devices on a network are trustworthy. However, this can no longer be the case in today’s connected world. Zero Trust security, based on the principle of least-privilege access, takes a “deny by default” stance and assumes that all devices are untrustworthy until proven otherwise. Zero Trust network access and an SDP architecture are purpose-built to enforce Zero Trust principles, offering organizations the following security benefits:
- All resources are invisible to unauthenticated and unauthorized people
- Identity, context, device risk posture and risk telemetry from integrated systems such as threat intelligence platforms and Endpoint Protection solutions ensure that the right users and devices enter your network.
- Just-in-time secure access is provided when trust is verified and is limited to segmented resources based on precise entitlements
HTBS helps you secure your organization with the Zero Trust approach, which will allow you to protect and secure every element of your infrastructure while gaining global visibility of your attack surface.
Source : Appgate
Sign up below to receive our weekly Newsletter: