Goodbye VPN and Welcome SDP

We all been used to using VPN. An application installed on your laptop or on your mobile device that allows you to access internal applications, whilst traversing an insecure public network. VPN has its advantages; However, the list of disadvantages is long and so in 2007 a new solution was created – the software defined perimeter. In this short blog I will provide an overview on VPN and SDP.

VPN

VPN (virtual private network) started first with an approach called Peer to Peer Tunnel Protocol (PPTP). The request for comment (RFC) 2637 being published by a consortium led by Microsoft in July 1996 and the main idea what to create a secure connection between two endpoints, allowing for secure communication between the two end points (typically an end user device and a secure endpoint like a firewall). The connection is also referred to as tunnel.  PPTP is not in use anymore as apparently the NSA managed to enter a PPTP rendering it unsecure.

As noted, VPN basically creates a secure (encrypted) connection between a client (say a laptop running windows or linux) and a server (being a network component). Secure means that the traffic between the two end points are encrypted with an encryption protocol.

The VPN security model provides:

• confidentiality such that even if the network traffic is sniffed at the packet level (see network sniffer and deep packet inspection), an attacker would see only encrypted data
• sender authentication to prevent unauthorized users from accessing the VPN
• message integrity to detect any instances of tampering with transmitted messages

However, as VPN is a design from the mid-1990s a number of challenges and restrictions exists (The list is longer, however here we consider only the key points): 

1. All or nothing:
• Traditional VPN services are too lenient, allowing staff to access much more network areas than they need for their day-to-day work. As a result, these resources assume unwarranted visibility and become more susceptible to compromise for phishing attempts
2. Speed : 
• As every communication has to traverse the server in order to be encrypted and decrypted each packet it can slow down the overall end to end performance
3. Open to attacks (MITM) : 
• In a security breach known as “man in the middle” (MITM), a cyber thief enters a communication channel between an application and a user that has an open VPN, resulting on potentially leaving an open door for the hacker
4. Not ideal for hybrid landscape : 
• As soon as the application moves across the local data centre to public cloud providers, hosing IaaS, SaaS or PaaS capabilities, VPN can become very complex

Because VPNs can be rather slow for users, introduce security risk, and are difficult to manage, Gartner predicts that, “By 2023, 60% of enterprises will phase out most of their remote access VPNs in favour of Zero Trust Network Access [SDPs].”

Software Defined Parameter

SDP was first developed by the Defense Information Systems Agency (DISA) that resulted from the Global Information Grid project back in 2007. In 2011, while SDP was still a new concept, Google became an early adopter with the development of its own SDP solution known as GoogleBeyond Corp.

SDP is a security approach that covers local, cloud and mobile. While VPN is typically focused around in data center, SDP is everywhere that uses business context policy to determine who gets access to what resources. SDP distributes access to internal applications based on a user’s identity and with trust that adapts based on context. SDPs are 100% software-defined and built on a “need-to-know” model, with trust that is constantly monitored and adapted based on a range of criteria. SDP makes application infrastructure invisible to the internet, so it evades network-based attacks (DDoS, ransomware, malware, server scanning, etc.), and reduces business risk.

1. One or more SDP Controllers are brought online and connected to the appropriate optional authentication and authorization
2. One or more Accepting SDP Hosts are brought online. These hosts connect to and authenticate to the Controllers.
3. Each Initiating SDP Host that is brought online connects with, and authenticates to, the SDP Controllers.
4. After authenticating the Initiating SDP Host, the SDP Controllers determine a list of Accepting Hosts to which the Initiating Host is authorized to communicate.
5. The SDP Controller instructs the Accepting SDP Hosts to accept communication from the Initiating Host as well as any optional policies required for encrypted communications.
6. The SDP Controller gives the Initiating SDP Host the list of Accepting Hosts as well as any optional policies required for encrypted communications.
7. The Initiating SDP Host initiates a mutual VPN connection to all authorized Accepting Hosts

Summary

It seems that like PPTP, VPN will be phased out over the next couple of years to be replaced with SDP. SDP seems like the new way for us to access confidential and secure applications and systems.

Thanks for Reading