TL;DR
Virtual private networks (VPNs) protect corporate networks but are vulnerable when credentials are compromised. Pairing a VPN with multi-factor authentication (MFA) — especially an adaptive MFA solution — creates a critical second layer of defense, dynamically adjusting security policies based on user, device, and location to keep organizational data safe without sacrificing workforce flexibility.
Where did the traditional network perimeter go?
The world of mobile technology has pushed organizations to diversify workflows, but as we diversify, so do the attacks. Before the proliferation of mobile devices, user credentials were protected by the corporate firewall. But times have changed.
There were 1.3 million malicious mobile installations blocked in 2017 by Kaspersky Lab. Endpoint security has become paramount in an age where identity is the new perimeter. In order to secure that perimeter, many organizations are looking to marry their current network infrastructures with new security solutions. This is where two security solutions can work together as one.
What is a VPN and how does it protect organizations?
VPN technology isn't new — it's been around for more than 15 years. But as times have changed, VPNs have too. Most VPN providers have embraced new ways of working by offering mobile endpoint security solutions, and a good VPN offers much more than just security-enhancing encryption.
Corporate VPNs offer several key advantages:
- Reduced breach risk: Greatly lowers the likelihood of security breaches and cyber attacks.
- Scalability and savings: More cost-effective than non-VPN remote-access services.
- Centralized IT control: Provides IT teams with the tools to manage and secure their domain.
What are the security risks of relying on a VPN alone?
VPNs offer excellent security, but they do come with their share of risks. Most VPNs require a traditional username and password combination, which can easily be guessed or stolen. Compromised VPN credentials are a far greater prize to attackers than a single application as they are often configured to give much greater access to tools and information. In the instance that VPN credentials fall into the wrong hands, malicious actors are essentially provided with the keys to your corporate network.
How does multi-factor authentication strengthen VPN security?
According to Verizon's 2017 Data Breach Investigations Report, 81% of data breaches involve weak or stolen credentials. VPNs should be secured like any other application that relies on a username and password combination — with MFA. A VPN without MFA is a house without a gate — with the right key, attackers can simply let themselves in. By implementing MFA with a VPN, organizations create a second layer of defence.
How does adaptive MFA address dynamic risks?
Risks, however, are not always static. Nowhere is this more evident than when managing a remote workforce, where neither the location nor the device used by each employee are consistent. An adaptive MFA solution mitigates this by dynamically adapting security and authentication policies based on:
- The user
- The device
- The location
This prompts a user for an additional factor (such as verifying a push notification or an email one-time passcode (OTP)).
VPNs ensure company tools and information remain secure and private, but if VPN log-in credentials are the keys to the kingdom, then another layer of security is crucial to ensure they don't fall into the wrong hands. Okta's adaptive MFA solution offers security without sacrificing the flexibility today's workforce demands.
Frequently asked questions
Why is a virtual private network (VPN) alone not enough to protect a corporate network?
VPNs rely on traditional username and password credentials, which can be guessed or stolen. Because VPN access often grants broad entry to corporate tools and data, compromised credentials give attackers far more than access to a single application — effectively handing them the keys to the entire network.
How does multi-factor authentication (MFA) improve virtual private network (VPN) security?
MFA adds a second layer of verification beyond a username and password. Even if credentials are stolen, an attacker cannot gain access without also passing the additional authentication step, such as approving a push notification or entering a one-time passcode (OTP).
What makes adaptive MFA different from standard MFA?
Unlike standard MFA, adaptive MFA dynamically adjusts authentication requirements based on contextual signals — including the user's identity, the device being used, and their location. This is especially valuable for remote workforces where these factors are rarely consistent.
What kinds of threats do corporate virtual private networks (VPNs) help defend against?
Corporate VPNs help reduce the risk of security breaches and cyber attacks by encrypting traffic and centralizing access controls. They also offer scalability and cost savings compared to traditional non-VPN remote-access services.
Why have virtual private networks (VPNs) become more important with the rise of mobile devices?
The proliferation of mobile devices has expanded the attack surface beyond the traditional corporate firewall. With identity now serving as the new security perimeter, VPNs provide mobile endpoint security that helps organizations maintain control over who accesses their resources.
What does it mean that 81% of data breaches involve weak or stolen credentials?
According to Verizon's 2017 Data Breach Investigations Report, the vast majority of breaches exploit credential vulnerabilities rather than technical exploits. This underscores why securing login points — like virtual private network (VPN) access — with multi-factor authentication (MFA) is a foundational security measure, not an optional one.
