What Are Your VPN Requirements?

From the perspective of a telecommuter or globe trotting road warrior, VPN requirements are fairly simple to define. They need an uncomplicated way of accessing a head office network from a remote location. Ideally the experience should be no different whether connected via LAN or VPN. Furthermore, laptop security disciplines shouldn't be any more onerous.

In fact, this simple outcome can be achieved via a WAN, so what is it that differentiates a VPN from a WAN?

While a WAN operates exclusively over dedicated leased lines or dial up connections, a VPN can also run across a public network such as the Internet. Without exception, any requirements list will include this feature. It is fundamental to the financial justification of a VPN deployment. This capability is responsible for benefits including:

• Lower costs.
• Faster deployment.
• Greater mobility.
• Scalability.
• Ease of use.

In summary, current VPN technologies should allow a remote worker to connect to a head office via an internet connection without special cabling or the necessity to install leased lines. Once VPN client software is installed on a laptop a connection should be achievable just about anywhere that an internet connection can be made, including a wireless hot spot.

For further information, see: "what is a VPN?"

While WANs operating over long distance leased lines are expensive, they are usually regarded as secure. As a consequence, it's normal for VPN requirements to specify that data security will be at least comparable with a WAN. To fulfil that requirement most VPNs use sophisticated authentication and encryption technology to achieve a similar level of data security. The adequacy of data security is a major concern for users of VPNs.

There is no doubt that VPN's are targeted by hackers. VPNs invariably belong to corporations and hence there is the assumption that they contain high value data. From the perspective of a hacker they're also tempting because whether they are secure or not often comes down to password strength and the usual human foibles associated their use. In response to this, it's now common for VPN requirements to specify additional methods of authentication that may include: device authentication options such as USB tokens, eTokens, dongles, biometric devices etc.

Despite these measures there are increasing concerns about the security of VPNs. By definition they can never be as secure as private leased lines, but that's rarely a reason for not deploying them. If data is extremely sensitive there are usually options available to off-set the risk. For example, extremely sensitive documents maybe encrypted using 128-bit, 192-bit or 256-bit laptop encryption before transmission via VPN.

From a network administrator's point of view the introduction of a VPN is a complex matter that involves significant planning if all stakeholders are to be content with the outcome. The starting point for such a project is to get the requirements agreed and documented before it begins.