Key takeaway
Limit VPN access by user, device and required resource; monitor client updates and logs.
What a VPN connection provides
A VPN tunnel can give a remote user access to internal resources and carry traffic over an encrypted channel. Network connectivity does not replace application authorization, so define resource access separately. Choose full or split tunneling based on security and performance requirements. With split tunneling, not all traffic passes through corporate controls.
Verify the user and device
Use strong authentication and multifactor verification; review the user and group membership before granting access. Track VPN client versions, operating-system support, cryptographic configuration and security updates. Restrict access from incompatible devices or devices showing signs of compromise. Also track VPN gateway versions, firmware and security updates.
Govern access and events
Segment the network so users reach only services required for their work. Close sessions on shared devices, revoke credentials for a lost device and test the alerting process.
Verify identity
Verify the user and group membership and require MFA.
Validate device and VPN posture
Check the managed device, client and gateway against policy and update requirements.
Restrict resources and routing
Permit required work resources, select approved full or split routing and verify application authorization separately.
Log the session and test revocation
Log session and policy events; test access revocation, safe recovery and session closure on shared devices.