• Kyser Clark

Communications Security for Remote Workers & Mobile Platforms


Many businesses have adopted "Work From Home" (formerly known as "telework" or "telecommunicating") as a permanent strategy due to its overall effectiveness during COVID-19. This new distributed workforce must be given a secure method of accessing the organization's internal networks and resources. Virtual Private Networks (VPNs) are a standard technological solution capable of resolving and compensating for the many privacy and security problems in such scenarios. A VPN tunnel may conceal part of your internet activities. A VPN tunnel links your smartphone, laptop, desktop computer, or tablet to another network where your IP address is concealed, and all your online browsing data is secured. Connecting to the internet through a VPN tunnel may prevent companies, government agencies, hackers, and other snoops from monitoring your online activities (Norton, n.d.). Organizations utilize VPNs for all the same reasons to protect sensitive information to and from the internal network and the remote worker's home network.

There are four main types of VPNs, each with its own set of pros and cons and different use cases:


Point to Point Tunneling Protocol (PPTP)

The PPTP protocol operates at the data link layer - layer 2 of the Open systems interconnection (OSI) model. It enables data to be transferred between a VPN server and another point on the network, such as a web page. This happens via an encrypted tunnel using Transmission Control Protocol (TCP) port 1723 and the General Routing Encapsulation (GRE) protocol (Spajic, 2022).

  • Pros

  • Fastest speeds

  • Simple setup

  • Usable on all platforms

  • Cons

  • Very weak encryption that can be broken in a day


Layer 2 Tunneling Protocol with Internet Protocol Security (L2TP/IPSec)

L2TP/IPsec was proposed as an upgrade to Layer 2 Forwarding Protocol (L2F) and PPTP because PPTP has weak encryption and authentication. L2TP/IPsec uses User Datagram Protocol (UDP) port 1701, commonly blocked by firewalls (ExpressVPN, n.d.).

  • Pros

  • More secure than PPTP

  • Cons

  • Slower than OpenVPN

  • Sometimes blocked by firewalls

  • Only moderate security

Secure Socket Tunneling Protocol (SSTP)

Developed by Microsoft to replace the insecure PPTP and L2TP/IPSec options, SSTP is native to Windows VPN connections and not very common in Linux environments. SSTP uses Secure Socket Layer/Transport Layer Security (SSL/TLS) for secure key negotiations and encrypted transfers. Since SSTP relies on SSL/TLS, it utilizes TCP port 443 and bases the connection on user authentication (Proofpoint, 2021).

  • Pros

  • More secure than PPTP and L2TP/IPSec

  • Typically not blocked by firewalls

  • Easily integrated into any Windows environment

  • Cons

  • Less reliable/stable than PPTP

  • Less transparency since Microsoft owns it

  • Not easily integrated into Linux environments


OpenVPN

As its name suggests, OpenVPN is an open-source VPN that uses SSL/TLS, much like the previous VPNs mentioned. However, unlike the other VPNs, OpenVPN uses X.509 certificates and strong cryptographic algorithms (Roomi, 2020).

  • Pros

  • Highest level of security with minimal performance loss

  • Reliable/Stable

  • Open-Source and community-supported

  • Works with many platforms

  • Firewall compatibility

  • Cost

  • Cons

  • Very Complex Setup

  • Not the most user-friendly

  • Third-Party software required for functionality

  • Increased latency


Summary

COVID-19 fast-tracked the world into remote work. Many employees refuse to return to the office as they would instead work from home. Because of this, it is impeccable for organizations to respond to these needs and desires by allowing employees to remote work. Organizations need to develop and utilize VPNs to enable this new phenomenon to provide secure and private connections to and from the organization's internal network and employees' home network. The four main VPN types are PPTP, L2TP/IPSec, SSTP, and OpenVPN. Each VPN type has its use-cases, benefits, and disadvantages. It is up to the organization's management to decide what they value the most when protecting their assets. Once settled, security architects can implement the VPN(s) as needed.


References


ExpressVPN. (n.d.). Layer 2 tunneling protocol L2TP/IPsec. https://www.expressvpn.com/what-is-vpn/protocols/l2tp


Norton. (n.d.). VPN tunnel: What is it and how does it work? Retrieved July 9, 2022, from https://us.norton.com/internetsecurity-privacy-what-is-a-vpn-tunnel.html


Proofpoint. (2021, October 9). What is SSTP? https://www.proofpoint.com/us/threat-reference/sstp


Roomi, M. (2020, August 25). 6 advantages and disadvantages of OpenVPN | Limitations & benefits of OpenVPN. HitechWhizz. https://www.hitechwhizz.com/2020/08/6-advantages-and-disadvantages-drawbacks-benefits-of-openvpn.html


Spajic, D. (2022, March 4). What is PPTP VPN protocol? Dataprot. Retrieved July 9, 2022, from https://dataprot.net/guides/what-is-pptp

1 view