A VPN provides a secure connection between user devices and one or more servers, without the need for a physical connection, effectively creating a private communication ‘tunnel’ across the public internet.

In any VPN model, when data packets are transmitted by a device, they are encrypted before they reach the internet service provider (ISP) layer and are subsequently decrypted on the server side. Data packets flowing from the organisation’s server to the device follow the same path, but in reverse.

Data packets flowing from the organisation’s server to the device follow the same path, but in reverse. This encryption/decryption procedure requires an agreed set of rules (i.e. a protocol). ‘SSL VPN’ indicates that the VPN service relies on the SSL (secure sockets layer) protocol for securing communications. In reality, SSL has now been largely replaced by an evolved protocol called Transport Layer Security (TLS). However, VPN models using TLS are still generally referred to as SSL VPN.

SSL VPNs rely on the TLS protocol to enable devices to securely access corporate networks. This protocol works as follows:

Communication is instigated with a ‘TLS handshake’, in which the device and server open a connection.

• This TLS handshake also involves the two parties creating randomly generated session encryption keys, which are used to encrypt and decrypt all communications. New keys are generated for each new connection session.
• The TLS protocol authenticates the device user. A message authentication code is also included with transmissions to ensure data has not been intercepted and layered in transit.
  At the server level, it is possible to build tunnels to specific applications. For businesses, this makes it easier to control user access, by restricting users’ connections only to those applications they have permission to use, rather than the entire corporate network.

Advantages

Deployment

IPsec VPNs usually require the installation of dedicated software on user devices. Especially for a large, scattered user-base, this can be complicated and expensive to set up. With SSL, users only need a web browser. Where a business wants to deploy a virtual network rapidly, without the need for additional installations, SSL VPNs are a very attractive option.

Ease of use

Once the network is deployed, a top priority for many businesses is to enable ongoing, secure connectivity for users, without having to field lots of technical queries. With SSL, there’s no need for ordinary users to worry about proprietary software configurations or updates. So long as they have an up-to-date browser in use, they are good to go.

Access control

IPsec is primarily designed to provide remote users with secure, comprehensive access to a network. A user can access not just file directories and programs but also things like printers and backups, as if they were in the office — IPsec is a good option if you want to create a ‘mirror’ office environment for remote workers.

However, with SSL VPN, it’s much easier to create tunnels to specific applications. This gives you fine-grained control over individual network access on a ‘need to know’ basis.

Disadvantages

Browser requirement

In order to implement an SSL VPN, devices require a web browser. For businesses, it’s a viable VPN option for items such as laptops, mobile phones, tablets and items such as user-operated control units, trackers and some point-of-sale equipment. However, for sensors, monitors, wearables and other IoT devices that do not have web browsing capabilities, its usage isn’t possible.

Security

SSL VPN enables ‘split tunnelling’, which lets a user’s device route some of their traffic through an encrypted tunnel, while still retaining direct access to the public internet. This means users get encrypted access to sensitive corporate materials, while still enabling them to use general internet resources without a drop-off in speed and performance.

The flipside is that split tunnelling can enable hackers to use the unsecured channel as an intermediary in an attack. More widely, compared to the IPsec model, an SSL network can be more susceptible to malware attacks. It’s important for users to ensure their browsers are updated to help reduce the risk of such attacks.

With the continued growth of remote and ‘blended’ working arrangements (where teams split their time between home and office), businesses need simple yet secure ways for individuals to access corporate assets, wherever they may be based.

The SSL VPN model can make it easier for individuals to make that connection, while also giving you full control over permissions and data access.