While VPN is departing, zero trust is staying

VPNs are part of a security strategy based on the notion of a network perimeter. But this model no longer works in a modern business environment where mobile users access the network from a variety of locations as corporate assets reside in multi-cloud environments.

VPN that has for decades provided remote workers with a secure tunnel into the enterprise network, is facing extinction as enterprises migrate to a more agile, granular security framework called zero trust, which is better adapted in the world of digital business.

VPN models no longer work in a modern business environment where mobile employees access the network from a variety of inside or outside locations, and where corporate assets reside not behind the walls of an enterprise data center, but in multi-cloud environments.

Gartner predicts that by 2023, 60% of enterprises will phase out most of their VPNs in favour of zero trust network access, which can take the form of a gateway or broker that authenticates both device and user before allowing role-based, context-aware access.

There are a variety of flaws associated with the perimeter approach to security. It doesn’t address insider attacks. It doesn’t do a good job accounting for contractors, third parties and supply-chain partners. If an attacker steals someone’s VPN credentials, the attacker can access the network and roam freely. Plus, VPNs over time have become complex and difficult to manage.

Despite the fact that the zero-trust framework has been around for a decade, and has generated quite a bit of interest, it has only been in the last year or so that enterprise adoption has begun to take off.

But zero trust is now gaining traction. Now, Vendors are coming at zero trust from all angles. Cisco, Microsoft and VMware all have zero-trust offerings. According to the Forrester Wave, Cisco and Microsoft are classified as strong performers and VMware is a contender.