Zero Trust
How to understand, apply and evolve Zero Trust to protect your organisation’s systems, data and users.
Page of 18
Zero trust migration: How will I know if I can remove my VPN?
Before we begin
As your organisation makes the transition to zero trust, you may begin to question whether you still need your Always On VPN (AOVPN). An AOVPN can feel like a bottleneck in a modern network architecture, so it can be tempting for organisations to see migrating to zero trust as an excuse to remove it. But we’ve noticed a worrying trend of organisations removing an AOVPN from their network before the appropriate zero trust measures are in place.
If you take away just one thing from this blog, it should be:
When migrating to a zero trust architecture, you shouldn’t remove your VPN unless you’ve achieved the same security benefits in other ways.
Important to consider
Migrating to zero trust isn’t as simple as moving your services off-premises, making use of software as a service (SaaS) and other services, and then turning off your AOVPN. In practice, you’ll need to consider whether every part of your network can implement the zero trust principles, including any legacy systems, and also think about how your client devices communicate securely with these services.
We’ll consider here some of the ways you might do this. You might also find the suggestions in Zero trust: Building a mixed estate helpful.
Advantages of an AOVPN
In a typical organisation, data-in-transit protection for remote clients is achieved using an AOVPN across an untrusted network. An AOVPN is also often used to facilitate defence-in-depth protection of resources and services behind an IP address allow-list.
Although they are the two main benefits of an AOVPN, our guidance summarises six other advantages:
- it enables legacy systems to work remotely
- it provides a second layer of defence against misconfigured, unpatched or poorly designed internal services
- it protects internal network servers from external and unauthenticated attackers
- it protects user devices from network attacks
- it forces traffic between a device and external services through internal protective-monitoring tools
- it allows for business monitoring and filtering of users’ network traffic
But it’s important to note that an AOVPN isn’t the only security control you need to adequately protect your network. Controls such as end-user device configuration and email security are still vital components of a secure architecture.
Migrating from an AOVPN applying the zero trust principles
We’ll now look at how you can replicate some of the security benefits of an AOVPN with additional technology, and which of the zero trust principles you’ll need to consider.
Note that this isn’t an exhaustive list, and none of these technologies will replace the benefits of an AOVPN in isolation, so to put in place the right combination of solutions for your network, it’s important to understand the properties each one provides.
Find out more
Now we’ve looked at the different factors to consider when migrating to a zero trust architecture, it’s worth reiterating our message at the start: removing an AOVPN should be done with care. You need to consider each of the security benefits an AOVPN adds to your network, and make sure you replicate each one in your zero trust architecture.
It’s also worth noting that your network may have some properties which mean an AOVPN will always be necessary. If your network is large, complex, or contains many legacy systems, you may find that it’s not possible to achieve the same level of security in a zero trust architecture with current technology. But even when this is the case, combining your existing AOVPN with additional zero trust technologies will still improve the overall security of your network.
To read more about zero trust, have a look at our previous blogs which consider whether zero trust is right for you (now archived), and where to start with migration. And don’t forget to keep the zero trust principles themselves at the forefront of every stage of your migration journey.