Point to point: The VPN is breaking up
Sep 2nd, 2023 by Jesper Kråkhede
The classic VPN puts the user on the network. Once you are connected, you can reach a large part of it, and so can any malware on your laptop. That is the opposite of Zero Trust.
What I think is the future instead is point to point access. Each connection is made between one user, on one verified device, and one specific application. Nothing else. The user never gets onto the network as such, only to the app he is allowed to use, and the decision is made again for every connection, based on identity, device health and risk.
The industry calls it Zero Trust Network Access, and it is growing fast. Microsoft announced Microsoft Entra Private Access in July, now in preview, which does exactly this for private applications on-premises and in any cloud. Conditional Access can then be applied to every single application, even legacy ones that never supported modern authentication.
Why is it better? An attacker with a stolen password and a compromised laptop gets access to one app at most, not the whole network. Lateral movement from the remote user is much harder. And the old VPN concentrators, which have been among the most exploited systems in recent years, can eventually be switched off.
It takes time. Every application needs to be mapped and published.
Connect people to apps, not to networks.