Why it's time to replace your agency's traditional VPN

For the past few decades, federal employees have been using VPN technology to access their networks, but this approach brings heightened complications. Not only are VPNs expensive and complex, but they expose sensitive federal data to increased security risks and provide feds with a poor user experience, especially for mobile users. Feds need a more secure and efficient solution now more than ever.

So, what’s the answer?

Connection headache

First, consider the status quo: To access a remote connection, federal users must go through a Trusted Internet Connection. The connection path starts with an open internet connection and a VPN client, back through the agency data center, through a stack of on-premise security devices, and then out through the TIC, where it traverses another stack of security appliances to its final destination, such as the open internet or cloud-based services. This process is then competed in reverse as the information requested returns back to the user. When the user leaves one destination and heads to another, this laborious process is repeated because users cannot traverse seamlessly between clouds – even those that are compliant with the Federal Risk and Authorization Management Program. This process is taxing on IT administration teams because constant maintenance and upkeep is required to align with federal TIC regulations.

Additionally, traditional VPNs provide federal users with an extremely poor user experience. Not only is the access process slow and inefficient, but users have no control or visibility throughout the process. The many appliances involved also increases complexity and costs – it is expensive to purchase, manage and maintain all required appliances.

While many agencies are facing challenges in terms of modernizing their VPNs, recent government IT modernization initiatives -- including the Cybersecurity Executive Order, the Modernizing Government Technology Act, and the Report to the President on IT Modernization -- are helping pave the way to a more efficient government. And, government telework opportunities are growing. For example, the General Services Administration has approved 90 percent of its workforce to work remotely.

To move the ball forward in an increasingly mobile world and keep up with the government IT modernization initiatives, agencies must find a way to enable secure, streamlined connections -- regardless of device or location.

In cloud we trust

Built to FedRAMP standards, cloud-based access services take an innovative approach that lets agencies route traffic directly to the cloud -- without requiring any hardware. The three core components of cloud computing -- the application, the broker and the connector -- enable a “trust-to-trust” approach, meaning a specific trusted user is connected to a specific trusted environment. Essentially, the broker acts as the policing force inside the cloud. When a remote user attempts to access an application, the broker determines if the user has the proper qualifications to access the application. Once the broker deems the user a trusted source, it finds the closest connector -- a small piece of software that connects to the user-application tunnel from anywhere -- regardless of location. This approach greatly reduces risk because it gives users specific access to specific applications, instead of access to everything. A traditional VPN, on the other hand, places the user directly on a network, increasing the potential risk for exposed data by magnifying the attack surface.

Further, this cloud-based approach allows mobile users to securely and efficiently access data on their smart phones, laptops, smart TVs and more. Cloud-based access services eliminate the need to use the TIC -- enabling a direct user-to-application connection, with no added roadblocks in between.

Additionally, cloud-based access services enable total visibility. Unlike a traditional VPN, this approach allows real-time visibility into user activity -- not after the fact – which greatly improves security. Agencies have more time to stop a potential cyber threat and ensure users' data is secure through a trust-to-trust connection.

With a FedRAMP-compliant access solution, agencies can accelerate cloud and shared services adoption in line with FITARA, the Cybersecurity EO and recommendations in the Report to the President on IT Modernization. This approach enables secure application migration from the data center to the cloud and from a legacy hub-and-spoke network to a modern direct-to-cloud architecture.

Currently, nine federal agencies are testing cloud-based access services for their employees, blazing the IT modernization path for the expansion of an efficient mobile federal workforce.

Traditional VPNs can expose sensitive data to increased risks; they are complex and expensive, and they provide a poor user experience. Agencies must take advantage of secure solutions that can accommodate today’s cloud-enabled, mobile workforce.