Virtual private networks
Evaluate VPN protection through tunnel endpoints, authentication, routing, device condition, and the resources reachable after connection.
The idea
A VPN establishes protected communication across another network. Remote-access VPNs connect a device or user to organizational resources; site-to-site VPNs connect network locations. Authentication, encryption, routing, and traffic restrictions determine the actual protection. A VPN changes reachability and transport security, but it does not make a device safe or remove the need for application-level authorization. Split tunneling and full tunneling have different operational implications.
In practice
A managed laptop uses an authenticated tunnel to reach approved internal services, with access scoped to the employee’s work.
A common misunderstanding
A VPN is not a guarantee of anonymity or a cure for a compromised endpoint.
Check your understanding
What should be reviewed beyond the tunnel’s encryption?
Think it through: Who can connect, device requirements, reachable resources, logs, and how access is revoked.
Draw the tunnel endpoints
Imagine a fictional academy gives instructors remote access to an internal grading service. A VPN can protect communication across an intervening network, but the diagram must show where the protection starts and ends. Traffic after tunnel termination has its own controls and visibility.
The instructor's laptop remains a security-relevant endpoint. If malicious software can use its active session or read its local data, tunnel encryption does not cure that compromise. Evaluate the device and the service alongside the protected path.
Access after connection is the critical policy
Suppose the grading service is the only required internal resource. Granting the instructor reachability to every server simply because the VPN connected creates unnecessary exposure. Identity, group membership, application permissions, and network restrictions should match the work.
The joiner, mover, and leaver lifecycle also matters. A revoked account or lost device should not retain an unexplained route into the environment. Review credential management, session termination, and the records available to investigate access.
Routing changes what is protected
Full-tunnel and split-tunnel arrangements send different traffic through the organizational gateway. Neither label alone explains the correct design. The team must understand which destinations use the tunnel, which use other paths, and how local network access interacts with the configuration.
For the instructor, a working public browser session does not prove that the internal grading path works. Name resolution, routes, device requirements, and service permissions can fail independently.
For a safe exercise, draw an instructor's laptop, an untrusted access network, the VPN gateway, and the grading service. Mark the authenticated identity, protected segment, and allowed resources. Add a lost-device scenario and state who revokes access and how the result is verified. This tests the operational access model rather than reducing the VPN to an anonymity claim or an encryption icon.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
Cisco: Networking basics