Secure remote access: SSL/TLS VPNs, split tunnelling, MFA and ZTNA

Remote access options

Most organisations now have people working from home, on client sites or while travelling. They need access to internal systems such as file shares, finance software and intranet pages without exposing those systems to the internet. The common options are a remote-access VPN (virtual private network), a clientless portal and ZTNA (zero trust network access). Site-to-site VPNs, which join whole networks, are covered in VPNs and site-to-site IPsec.

IPsec and SSL/TLS VPNs

A clientless SSL portal lets a user log in from a browser and open specific web applications or remote desktops without installing anything. It is handy for contractors but gives less control over the device being used.

Full tunnel or split tunnel?

With a full tunnel, the laptop sends everything through the VPN, so the company firewall and web filter see all traffic. With a split tunnel, only traffic for company networks uses the VPN and everything else goes straight to the internet. Split tunnelling reduces load and helps video calls, but the device then needs its own protection, such as endpoint security and a cloud web gateway. Whichever you choose, write it down in the remote access policy.

Hardening the VPN gateway

Because a VPN gateway faces the internet and leads straight into the network, attackers scan for them constantly, and national cyber agencies regularly warn about flaws in VPN appliances. Treat the gateway as a high-value system:

• Patch quickly: subscribe to the vendor's security advisories and apply critical fixes within days.
• Require MFA (multi-factor authentication) for every user, ideally phishing-resistant methods such as passkeys or certificates.
• Check device posture: allow only managed devices with a company certificate, current patches and endpoint protection.
• Limit access after login: give each group only the subnets or applications it needs, instead of the whole network.
• Turn off unused features, such as old portal pages or legacy protocols, and remove accounts promptly when people leave.
• Log and monitor logins, failed attempts and unusual locations, and send the logs to your SIEM.

Moving to zero trust network access

A traditional VPN places the user on the network, which can let an attacker with stolen credentials move around. ZTNA instead connects a verified user on a healthy device to one named application at a time, often through a cloud broker, so internal addresses are never exposed. Many organisations run both for a while, moving web applications to ZTNA first. See Zero trust architecture and network segmentation.

Real-world example: an architecture practice with 40 staff used a VPN with passwords only and full network access. After a member of staff's password was reused on a breached website, the firm noticed logins from abroad. It reset the password, turned on MFA with an authenticator app for everyone, restricted VPN users to the file server and the drawing licence server, and set the gateway to accept only company laptops with a device certificate. It also put the gateway on an automatic patch schedule with a monthly check.