Connecting remote staff securely to the company network takes more than installing VPN software. Access limits, multi-factor authentication, device checks and an up-to-date VPN gateway need to be planned together.
A remote team needs to reach the office file server, the accounting software or internal applications from home or on the road. The usual way to provide this is a VPN, but one set up in a hurry can become a wide door from the internet straight into the company network. A secure setup depends less on getting the connection software running and more on designing who connects to what, from which device and under which conditions.
What a VPN does, and what it doesn't
A VPN (virtual private network) builds an encrypted tunnel over the internet between an employee's device and the company network. The tunnel makes it harder for others to read or alter data in transit. The type used for remote working is called a "remote access VPN"; a "site-to-site VPN", which permanently links two offices, is a separate scenario.
It is just as important to know what a VPN does not do. If the connecting device carries malware, the tunnel carries that malware into the company network too. An account whose username and password have been stolen can come in through the VPN looking like a legitimate user. In other words, a VPN provides a secure road; you still need to protect the identity and the device at each end of it.
Start with an access map
The most common mistake is opening the whole office network to everyone who connects over the VPN. Instead, match roles to the resources they actually need. For example, the accounting team reaches only the accounting server and the shared accounting folder, the sales team reaches the customer management application, and the IT administrator reaches the management interfaces. Cameras, printers and production equipment should not appear on the remote access list at all.
Enforce this mapping with rules based on user groups on the VPN device or firewall. That way, even if an account is compromised, what an attacker can reach is limited to the few resources that account genuinely needs. Give external support companies separate accounts with a separate, narrower set of rules, and keep their access time-limited.
Choose a current protocol
VPNs run on different protocols. Today, IPsec set up with IKEv2 and TLS-based solutions (often referred to as "SSL VPN") are widely used and considered reliable. Older protocols such as PPTP are no longer regarded as secure; if your existing setup still uses one, it needs replacing. Whatever the protocol, use the current encryption settings the manufacturer recommends and keep legacy compatibility options switched off unless they are genuinely needed.
Strengthen authentication
A username and password alone are not enough for VPN sign-in. Multi-factor authentication (asking for a second proof in addition to the password, such as an approval on a phone or a one-time code) helps stop stolen passwords from being enough on their own. Make it mandatory from day one; adding it later means changing users' habits.
Give every employee their own account; don't use shared accounts named "remote" or "vpn". With a shared account you cannot tell who connected, and you cannot close access for a single departing employee. Where possible, link VPN sign-in to the company's main user directory, so that when an employee's account is disabled, their VPN access closes automatically too. On company devices, requiring a certificate installed on the device, in addition to the user's identity, ensures that only recognised devices can connect.
Account for the connecting device
A VPN connection from a shared home computer, an unpatched laptop or a machine the children install games on brings the risks of that device into the company network. The preferred approach is to limit VPN access to devices the company manages. On those devices, operating system updates, endpoint protection, disk encryption and screen lock can be checked centrally.
If you have to allow personal devices, narrow their access: for example, to email and applications that run in the browser only. Some VPN solutions can check, before connecting, whether the device is up to date and whether its protection software is running; if yours offers this, consider turning it on.
All traffic, or company traffic only?
While the VPN is on, should all of the user's internet traffic go through the company, or only traffic heading for company resources? The first is known as a "full tunnel", the second as "split tunneling". Both have their place:
| Full tunnel | Split tunnel | |
|---|---|---|
| Traffic path | All internet traffic exits through the company network | Only traffic to company resources enters the tunnel |
| Oversight | The company's web filtering and security rules apply | General internet traffic stays outside company oversight |
| Line load | Adds load to the office internet line | The office line is less affected |
| Suits | Roles that handle sensitive data and need close oversight | Setups with heavy cloud application use and limited line capacity |
If you choose split tunneling, protection on the device itself matters more, because internet traffic does not pass through the company firewall. Base the choice on your office line's capacity and on which resources staff actually use.
Keep the VPN device updated and lean
Because the VPN gateway sits directly on the internet, it is a target attackers scan constantly. VPN products appear frequently in manufacturers' security advisories, and known vulnerabilities can be exploited quickly. So take VPN device updates out of the routine maintenance calendar: when a critical security fix is released, apply it without waiting weeks.
Switch off features you don't use, such as a web portal or support for older clients. Don't expose the device's management interface to the internet; manage it only from the internal network or from specific addresses. A VPN device that has reached end of support will no longer receive updates, which makes it a priority for replacement.
Exposing Remote Desktop (RDP) directly to the internet can look more convenient than setting up a VPN, but these connections are a frequent target of password-guessing attacks. If you need Remote Desktop, use it behind the VPN, reachable only by the users concerned.
Monitor connections
VPN logs show who connected, when, from which address and for how long. Watch for unusual connections outside working hours, sign-ins from countries where you have no staff, the same account connected from two places at once, and repeated failed login attempts. Turn on settings that temporarily lock an account or block the source address after a set number of failed attempts.
Make sure sessions left idle for a long time close automatically. A forgotten open session is a ready-made path into the company network if the device falls into someone else's hands.
Roll it out in stages
Try the new VPN with a small pilot group first. Test connections from different home broadband lines, mobile data and shared wireless networks such as hotels, and note the problems users run into most. Prepare a short guide covering the setup steps, how to use multi-factor authentication and what to do when someone changes their phone. Retire the old remote access method in a planned way once the new one is working smoothly; leaving both open for a long time doubles the risk.
Checklist
- Has it been decided which resources each role can reach over the VPN, and is this enforced with rules?
- Have old protocols such as PPTP been switched off, and are current encryption settings in use?
- Is multi-factor authentication mandatory for VPN sign-in?
- Does everyone have a personal account, and have shared VPN accounts been removed?
- Is VPN access limited to company-managed, up-to-date and protected devices?
- Are security updates for the VPN device applied promptly, and is its management interface closed to the internet?
- Are unusual times, locations and failed login attempts monitored in the logs?
- Do idle sessions close automatically?