Many businesses have adopted "Work From Home" (formerly known as "telework" or "telecommunicating") as a permanent strategy due to its overall effectiveness during COVID-19. This new distributed workforce must be given a secure method of accessing the organization's internal networks and resources. Virtual Private Networks (VPNs) are a standard technological solution capable of resolving and compensating for the many privacy and security problems in such scenarios. A VPN tunnel may conceal part of your internet activities. A VPN tunnel links your smartphone, laptop, desktop computer, or tablet to another network where your IP address is concealed, and all your online browsing data is secured. Connecting to the internet through a VPN tunnel may prevent companies, government agencies, hackers, and other snoops from monitoring your online activities (Norton, n.d.). Organizations utilize VPNs for all the same reasons to protect sensitive information to and from the internal network and the remote worker's home network.
There are four main types of VPNs, each with its own set of pros and cons and different use cases:
Point to Point Tunneling Protocol (PPTP)
The PPTP protocol operates at the data link layer - layer 2 of the Open systems interconnection (OSI) model. It enables data to be transferred between a VPN server and another point on the network, such as a web page. This happens via an encrypted tunnel using Transmission Control Protocol (TCP) port 1723 and the General Routing Encapsulation (GRE) protocol (Spajic, 2022).
Pros
Fastest speeds
Simple setup
Usable on all platforms
Cons
Very weak encryption that can be broken in a day
Layer 2 Tunneling Protocol with Internet Protocol Security (L2TP/IPSec)
L2TP/IPsec was proposed as an upgrade to Layer 2 Forwarding Protocol (L2F) and PPTP because PPTP has weak encryption and authentication. L2TP/IPsec uses User Datagram Protocol (UDP) port 1701, commonly blocked by firewalls (ExpressVPN, n.d.).
Pros
More secure than PPTP
Cons
Slower than OpenVPN
Sometimes blocked by firewalls
Only moderate security
Secure Socket Tunneling Protocol (SSTP)
Developed by Microsoft to replace the insecure PPTP and L2TP/IPSec options, SSTP is native to Windows VPN connections and not very common in Linux environments. SSTP uses Secure Socket Layer/Transport Layer Security (SSL/TLS) for secure key negotiations and encrypted transfers. Since SSTP relies on SSL/TLS, it utilizes TCP port 443 and bases the connection on user authentication (Proofpoint, 2021).
Pros
More secure than PPTP and L2TP/IPSec
Typically not blocked by firewalls
Easily integrated into any Windows environment
Cons
Less reliable/stable than PPTP
Less transparency since Microsoft owns it
Not easily integrated into Linux environments
OpenVPN
As its name suggests, OpenVPN is an open-source VPN that uses SSL/TLS, much like the previous VPNs mentioned. However, unlike the other VPNs, OpenVPN uses X.509 certificates and strong cryptographic algorithms (Roomi, 2020).
Pros
Highest level of security with minimal performance loss
Reliable/Stable
Open-Source and community-supported
Works with many platforms
Firewall compatibility
Cost
Cons
Very Complex Setup
Not the most user-friendly
Third-Party software required for functionality
Increased latency
Summary
COVID-19 fast-tracked the world into remote work. Many employees refuse to return to the office as they would instead work from home. Because of this, it is impeccable for organizations to respond to these needs and desires by allowing employees to remote work. Organizations need to develop and utilize VPNs to enable this new phenomenon to provide secure and private connections to and from the organization's internal network and employees' home network. The four main VPN types are PPTP, L2TP/IPSec, SSTP, and OpenVPN. Each VPN type has its use-cases, benefits, and disadvantages. It is up to the organization's management to decide what they value the most when protecting their assets. Once settled, security architects can implement the VPN(s) as needed.
References
ExpressVPN. (n.d.). Layer 2 tunneling protocol L2TP/IPsec. https://www.expressvpn.com/what-is-vpn/protocols/l2tp
Norton. (n.d.). VPN tunnel: What is it and how does it work? Retrieved July 9, 2022, from https://us.norton.com/internetsecurity-privacy-what-is-a-vpn-tunnel.html
Proofpoint. (2021, October 9). What is SSTP? https://www.proofpoint.com/us/threat-reference/sstp
Roomi, M. (2020, August 25). 6 advantages and disadvantages of OpenVPN | Limitations & benefits of OpenVPN. HitechWhizz. https://www.hitechwhizz.com/2020/08/6-advantages-and-disadvantages-drawbacks-benefits-of-openvpn.html
Spajic, D. (2022, March 4). What is PPTP VPN protocol? Dataprot. Retrieved July 9, 2022, from https://dataprot.net/guides/what-is-pptp